What’s Vulnerable › Products

Svelte Kit vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your Svelte Kit version is affected

Latest Svelte Kit vulnerabilities

• CVE-2026-40074 — SvelteKit's invalidated redirect in handle hook causes Denial-of-Service (CVSS 7.5)
• CVE-2026-40073 — SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node (CVSS 7.5)
• CVE-2026-22803 — SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer (CVSS 7.5)
• CVE-2025-67647 — SvelteKit Denial of service and possible SSRF when using prerendering (CVSS 9.1)
• CVE-2024-23641 — Sending a GET or HEAD request with a body crashes SvelteKit (CVSS 7.5)