# @sveltejs/kit (npm) vulnerabilities 19 known vulnerabilities (9 high, 6 medium, 4 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.1.1 (Oct 29, 2026): no advisory affects it - Newest unaffected release: 3.1.1 (Oct 29, 2026), the latest release - Weekly downloads: 4.5M - Dependents: 15 - Releases: 500+ since 1.0.0 (Dec 14, 2022) - Registry: https://www.npmjs.com/package/@sveltejs/kit - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-114061: 1.0.0-next.488 to 3.0.0-next.32 (3.0.0 is outside it) - CVE-2026-114060: 1.0.0-next.488 to 3.0.0-next.32 (3.0.0 is outside it) - CVE-2026-82261: 2.49.0 to 2.52.0 (2.52.2 is outside it) - CVE-2026-82260: 2.49.0 to 2.52.0 (2.52.2 is outside it) - CVE-2026-82259: 2.49.0 to 2.53.2 (2.53.3 is outside it) - CVE-2026-82258: 2.38.0 to 2.60.0 (2.60.1 is outside it) - CVE-2026-82257: 1.0.0-next.488 to 2.69.0 (2.69.1 is outside it) - CVE-2026-82256: 1.0.0-next.488 to 2.69.0 (2.69.1 is outside it) - CVE-2026-66062: 1.0.0-next.488 to 2.70.1 (2.70.2 is outside it) - CVE-2026-40074: 1.0.0-next.488 to 2.57.0 (2.57.1 is outside it) - CVE-2026-40073: 1.0.0-next.488 to 2.57.0 (2.57.1 is outside it) - CVE-2026-22803: 2.49.0 to 2.49.4 (2.49.5 is outside it) - CVE-2025-67647: 2.19.0 to 2.49.4 (2.49.5 is outside it) - CVE-2025-32388: 2.0.0 to 2.20.5 (2.20.6 is outside it) - CVE-2024-53261: 1.0.0-next.488 to 2.8.2 (2.8.3 is outside it) - CVE-2024-53262: 1.0.0-next.488 to 2.8.2 (2.8.3 is outside it) - CVE-2024-23641: 2.0.0 to 2.4.2 (2.4.3 is outside it) - CVE-2023-29008: 1.0.0-next.488 to 1.15.1 (1.15.2 is outside it) - CVE-2023-29003: 1.0.0-next.488 to 1.15.0 (1.15.1 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (19) ### [CVE-2026-114061](https://cve.now/CVE-2026-114061): SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages - Severity: Low 2.3 - Published: Oct 21, 2026 - Affected: fixed in 3.0.0. - Fixed in 3.0.0 (released Oct 1, 2026, 20 days before disclosure). - The latest release, 3.1.1, is not affected. - 74% of @sveltejs/kit downloads last week were affected versions (3.9M). ### [CVE-2026-114060](https://cve.now/CVE-2026-114060): SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions - Severity: Low 2.1 - Published: Oct 21, 2026 - Affected: fixed in 3.0.0. - Fixed in 3.0.0 (released Oct 1, 2026, 20 days before disclosure). - The latest release, 3.1.1, is not affected. - 74% of @sveltejs/kit downloads last week were affected versions (3.9M). ### [CVE-2026-82261](https://cve.now/CVE-2026-82261): SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization - Severity: High 8.7 - Published: Aug 28, 2026 - Affected: from 2.49.0, fixed in 2.52.2. - Fixed in 2.52.2 (released Feb 18, 2026, 191 days before disclosure). - The latest release, 3.1.1, is not affected. - 2.3% of @sveltejs/kit downloads last week were affected versions (121.7K). ### [CVE-2026-82260](https://cve.now/CVE-2026-82260): SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization - Severity: High 8.7 - Published: Aug 28, 2026 - Affected: from 2.49.0, fixed in 2.52.2. - Fixed in 2.52.2 (released Feb 18, 2026, 191 days before disclosure). - The latest release, 3.1.1, is not affected. - 2.3% of @sveltejs/kit downloads last week were affected versions (121.7K). ### [CVE-2026-82259](https://cve.now/CVE-2026-82259): SvelteKit 2.49.0 before 2.53.3 Denial of Service via form - Severity: High 8.7 - Published: Aug 28, 2026 - Affected: from 2.49.0, fixed in 2.53.3. - Fixed in 2.53.3 (released Feb 26, 2026, 183 days before disclosure). - The latest release, 3.1.1, is not affected. - 2.6% of @sveltejs/kit downloads last week were affected versions (136.7K). ### [CVE-2026-82258](https://cve.now/CVE-2026-82258): SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch - Severity: Medium 5.9 - Published: Aug 28, 2026 - Affected: from 2.38.0, fixed in 2.60.1. - Fixed in 2.60.1 (released May 14, 2026, 106 days before disclosure). - The latest release, 3.1.1, is not affected. - 11% of @sveltejs/kit downloads last week were affected versions (584.6K). ### [CVE-2026-82257](https://cve.now/CVE-2026-82257): SvelteKit before 2.69.1 Prototype Pollution via File Input - Severity: Medium 5.3 - Published: Aug 28, 2026 - Affected: fixed in 2.69.1. - Fixed in 2.69.1 (released Jul 2, 2026, 57 days before disclosure). - The latest release, 3.1.1, is not affected. - 39% of @sveltejs/kit downloads last week were affected versions (2M). ### [CVE-2026-82256](https://cve.now/CVE-2026-82256): SvelteKit before 2.69.1 Denial of Service via Remote Form - Severity: Medium 6.9 - Published: Aug 28, 2026 - Affected: fixed in 2.69.1. - Fixed in 2.69.1 (released Jul 2, 2026, 57 days before disclosure). - The latest release, 3.1.1, is not affected. - 39% of @sveltejs/kit downloads last week were affected versions (2M). ### [CVE-2026-66062](https://cve.now/CVE-2026-66062): SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header - Severity: Medium 5.3 - Published: Aug 7, 2026 - Affected: fixed in 2.70.2. - Fixed in 2.70.2 (released Jul 29, 2026, 9 days before disclosure). - The latest release, 3.1.1, is not affected. - 41% of @sveltejs/kit downloads last week were affected versions (2.2M). ### [CVE-2026-40074](https://cve.now/CVE-2026-40074): SvelteKit's invalidated redirect in handle hook causes Denial-of-Service - Severity: Medium 6.3 - Published: Apr 10, 2026 - Affected: fixed in 2.57.1. - Fixed in 2.57.1 (released Apr 9, 2026, 1 day before disclosure). - The latest release, 3.1.1, is not affected. - 32% of @sveltejs/kit downloads last week were affected versions (1.7M). ### [CVE-2026-40073](https://cve.now/CVE-2026-40073): SvelteKit has a BODY\_SIZE\_LIMIT bypass in @sveltejs/adapter-node - Severity: High 8.2 - Published: Apr 10, 2026 - Affected: fixed in 2.57.1. - Fixed in 2.57.1 (released Apr 9, 2026, 1 day before disclosure). - The latest release, 3.1.1, is not affected. - 32% of @sveltejs/kit downloads last week were affected versions (1.7M). ### [CVE-2026-22803](https://cve.now/CVE-2026-22803): SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer - Severity: High 8.2 - Published: Jan 15, 2026 - Affected: from 2.49.0, fixed in 2.49.5. - Fixed in 2.49.5 (released Jan 15, 2026, the day of disclosure). - The latest release, 3.1.1, is not affected. - 1.3% of @sveltejs/kit downloads last week were affected versions (70K). ### [CVE-2025-67647](https://cve.now/CVE-2025-67647): SvelteKit Denial of service and possible SSRF when using prerendering - Severity: High 8.4 - Published: Jan 15, 2026 - Affected: from 2.19.0, fixed in 2.49.5. - Fixed in 2.49.5 (released Jan 15, 2026, the day of disclosure). - The latest release, 3.1.1, is not affected. - 24% of @sveltejs/kit downloads last week were affected versions (1.3M). ### [CVE-2025-32388](https://cve.now/CVE-2025-32388): SvelteKit allows XSS via tracked search\_params - Severity: Medium 5.4 - Published: Apr 15, 2025 - Affected: from 2.0.0, fixed in 2.20.6. - Fixed in 2.20.6 (released Apr 14, 2025, 1 day before disclosure). - The latest release, 3.1.1, is not affected. - 2.7% of @sveltejs/kit downloads last week were affected versions (142.5K). ### [CVE-2024-53261](https://cve.now/CVE-2024-53261): Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit - Severity: Low 2.0 - Published: Nov 25, 2024 - Affected: fixed in 2.8.3. - Fixed in 2.8.3 (released Nov 25, 2024, the day of disclosure). - The latest release, 3.1.1, is not affected. - 2.8% of @sveltejs/kit downloads last week were affected versions (145.4K). ### [CVE-2024-53262](https://cve.now/CVE-2024-53262): Unescaped error message included on error page in SvelteKit - Severity: Low 2.0 - Published: Nov 25, 2024 - Affected: fixed in 2.8.3. - Fixed in 2.8.3 (released Nov 25, 2024, the day of disclosure). - The latest release, 3.1.1, is not affected. - 2.8% of @sveltejs/kit downloads last week were affected versions (145.4K). ### [CVE-2024-23641](https://cve.now/CVE-2024-23641): Sending a GET or HEAD request with a body crashes SvelteKit - Severity: High 7.5 - Published: Jan 24, 2024 - Affected: from 2.0.0, fixed in 2.4.3. - Fixed in 2.4.3 (released Jan 22, 2024, 2 days before disclosure). - The latest release, 3.1.1, is not affected. - 0.2% of @sveltejs/kit downloads last week were affected versions (8.1K). ### [CVE-2023-29008](https://cve.now/CVE-2023-29008): SvelteKit framework has Insufficient CSRF protection for CORS requests - Severity: High 8.8 - Published: Apr 6, 2023 - Affected: fixed in 1.15.2. - Fixed in 1.15.2 (released Apr 6, 2023, the day of disclosure). - The latest release, 3.1.1, is not affected. - 0.5% of @sveltejs/kit downloads last week were affected versions (26.6K). ### [CVE-2023-29003](https://cve.now/CVE-2023-29003): SvelteKit has Insufficient Cross-Site Request Forgery Protection - Severity: High 8.8 - Published: Apr 4, 2023 - Affected: fixed in 1.15.1. - Fixed in 1.15.1 (released Apr 4, 2023, the day of disclosure). - The latest release, 3.1.1, is not affected. - 0.5% of @sveltejs/kit downloads last week were affected versions (26.5K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@sveltejs/kit Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.