- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 19 · 9 high, 6 medium, 4 low
- Weekly downloads
- 4.5M
- Dependents
- 15
- Registry
- npm
Advisories 19
- CVE-2026-114061Low 2.3
SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
Affected: fixed in 3.0.0.
- CVE-2026-114060Low 2.1
SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
Affected: fixed in 3.0.0.
- CVE-2026-82261High 8.7
SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
Affected: from 2.49.0, fixed in 2.52.2.
- CVE-2026-82260High 8.7
SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
Affected: from 2.49.0, fixed in 2.52.2.
- CVE-2026-82259High 8.7
SvelteKit 2.49.0 before 2.53.3 Denial of Service via form
Affected: from 2.49.0, fixed in 2.53.3.
- CVE-2026-82258Medium 5.9
SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch
Affected: from 2.38.0, fixed in 2.60.1.
- CVE-2026-82257Medium 5.3
SvelteKit before 2.69.1 Prototype Pollution via File Input
Affected: fixed in 2.69.1.
- CVE-2026-82256Medium 6.9
SvelteKit before 2.69.1 Denial of Service via Remote Form
Affected: fixed in 2.69.1.
- CVE-2026-66062Medium 5.3
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
Affected: fixed in 2.70.2.
- CVE-2026-40074Medium 6.3
SvelteKit's invalidated redirect in handle hook causes Denial-of-Service
Affected: fixed in 2.57.1.
- CVE-2026-40073High 8.2
SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node
Affected: fixed in 2.57.1.
- CVE-2026-22803High 8.2
SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer
Affected: from 2.49.0, fixed in 2.49.5.
- CVE-2025-67647High 8.4
SvelteKit Denial of service and possible SSRF when using prerendering
Affected: from 2.19.0, fixed in 2.49.5.
- CVE-2025-32388Medium 5.4
SvelteKit allows XSS via tracked search_params
Affected: from 2.0.0, fixed in 2.20.6.
- CVE-2024-53261Low 2.0
Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit
Affected: fixed in 2.8.3.
Show all 19 advisoriesShow fewer advisories
- CVE-2024-53262Low 2.0
Unescaped error message included on error page in SvelteKit
Affected: fixed in 2.8.3.
- CVE-2024-23641High 7.5
Sending a GET or HEAD request with a body crashes SvelteKit
Affected: from 2.0.0, fixed in 2.4.3.
- CVE-2023-29008High 8.8
SvelteKit framework has Insufficient CSRF protection for CORS requests
Affected: fixed in 1.15.2.
- CVE-2023-29003High 8.8
SvelteKit has Insufficient Cross-Site Request Forgery Protection
Affected: fixed in 1.15.1.