What’s Vulnerable › Products

sveltejs kit vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your sveltejs kit version is affected

Latest sveltejs kit vulnerabilities

• CVE-2026-114063 — SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows (CVSS 7.5)
• CVE-2026-114062 — SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks (CVSS 5.3)
• CVE-2026-114060 — SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions (CVSS 4.7)
• CVE-2026-114061 — SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages (CVSS 4.7)
• CVE-2026-82261 — SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization (CVSS 7.5)
• CVE-2026-82260 — SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization (CVSS 7.5)
• CVE-2026-82259 — SvelteKit 2.49.0 before 2.53.3 Denial of Service via form (CVSS 7.5)
• CVE-2026-82258 — SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch (CVSS 4.8)
• CVE-2026-82257 — SvelteKit before 2.69.1 Prototype Pollution via File Input (CVSS 4.3)
• CVE-2026-82256 — SvelteKit before 2.69.1 Denial of Service via Remote Form (CVSS 5.3)
• CVE-2026-66062 — SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header (CVSS 5.3)
• CVE-2026-27118 — Cache poisoning in @sveltejs/adapter-vercel (CVSS 5.3)
• CVE-2025-32388 — SvelteKit allows XSS via tracked search_params (CVSS 5.4)
• CVE-2024-53262 — Unescaped error message included on error page in SvelteKit (CVSS 5.4)
• CVE-2024-53261 — Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit (CVSS 5.4)
• CVE-2023-29008 — SvelteKit framework has Insufficient CSRF protection for CORS requests (CVSS 8.8)
• CVE-2023-29003 — SvelteKit has Insufficient Cross-Site Request Forgery Protection (CVSS 8.8)