CVE-2026-82258: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in sveltejs kit

CVE-2026-82258 is a race condition vulnerability in SvelteKit's query.batch implementation affecting versions >=2.38.0 and <2.60.1. The flaw allows concurrent requests from different users to be processed under a shared request context due to improper synchronization, enabling attackers to exploit timing conditions to access sensitive data from other users' requests. The CVSS 4.0 score is 5.9 (medium severity), reflecting network attack vector, high complexity, partial privileges required, and partial impact on confidentiality and integrity.

An attacker who can trigger concurrent requests may gain unauthorized access to sensitive data belonging to other users by exploiting the race condition. This could lead to information disclosure within affected SvelteKit applications. There is no indication of privilege escalation or availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing request isolation or serialization mechanisms at the application level to prevent concurrent request merging. Monitor vendor channels for updates and apply official patches once released.