CVE-2025-67647: SvelteKit Denial of service and possible SSRF when using prerendering

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-15 · updated 2026-06-17
Weakness: CWE-248

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. This vulnerability is fixed in 2.49.5.

Affected products

Svelte Adapter-Node: from 5.4.1 before 5.5.1 — fixed in 5.5.1
Svelte Kit: from 2.19.0 before 2.49.5 — fixed in 2.49.5

How to fix

Upgrade to a fixed version: Svelte Adapter-Node 5.5.1; Svelte Kit 2.49.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-67647 or the next vulnerability affects your stack