SvelteKit versions from 2.10.0 up to but not including 3.0.0 have a path traversal vulnerability in the vite preview server on Windows. This flaw allows unauthenticated attackers with network or tunnel access to the preview server to read files outside the intended prerendered output directory. Exploitation can expose sensitive files such as source code, configuration files, or credentials accessible by the server process.
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.
SvelteKit versions before 3.0.0 have a low-severity cross-site scripting (XSS) vulnerability in prerendered pages. This occurs because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker able to influence this untrusted value at prerender time can inject HTML or JavaScript that executes when users visit the page.
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.
CVE-2026-81176 is a denial of service vulnerability in the sveltejs devalue JavaScript library prior to version 5.9.2. The issue arises because devalue.parse does not reject out-of-bounds indices, leading to excessive computational work when parsing specially crafted untrusted payloads. This can cause applications using vulnerable versions to experience performance degradation or denial of service. The vulnerability is fixed in version 5.9.2.
SvelteKit versions 2.49.0 through 2.52.1 with experimental remote functions and form enabled have a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive, resulting in denial of service. This issue is fixed in version 2.52.2.
SvelteKit versions 2.49.0 through 2.52.1 with experimental remote functions and form enabled have a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server and causing denial of service. This issue is fixed in version 2.52.2.
SvelteKit versions 2.49.0 through 2.53.2 have a deserialization vulnerability in the experimental remote function feature. This issue arises when the form function processes the files array without validating the number or size of files, allowing attackers to submit small inputs that expand into large file arrays. This can cause expensive processing and lead to denial of service. The vulnerability is fixed in version 2.53.3.
SvelteKit versions from 2.38.0 up to but not including 2.60.1 have a race condition vulnerability in the query.batch function. This flaw allows concurrent requests from different users to merge under a single request context, potentially exposing sensitive data across users. The vulnerability arises from improper synchronization of shared resources during concurrent execution.
SvelteKit versions before 2.69.1 have a prototype pollution vulnerability in remote form functions that handle file input fields with user-controlled path names. This flaw allows attackers to manipulate the deletion path to remove methods on the prototype, which can disable application functionality. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity.
CVE-2026-82256 is a vulnerability in SvelteKit versions before 2.69.1 where the application fails to properly validate the size of remote form function payloads. This flaw allows attackers to send excessively large payloads that crash the Node.js process running the application. Repeated exploitation can cause a denial of service by continuously crashing the application process.
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.
Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires. This issue has been patched in version 5.55.7.
Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.
Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.