Sveltejs vulnerabilities
48 CVEs and advisories name Sveltejs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-123569Devalue before 5.6.3 Denial of Service via Sparse Array Serialization
- CVE-2026-123568Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output
- CVE-2026-123567Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten
- CVE-2026-123566Devalue before 5.9.3 CPU Amplification Denial of Service via uneval
- CVE-2026-123565Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval
- CVE-2026-123564Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays
- CVE-2026-123563Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse
- CVE-2026-123562Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection
- CVE-2026-123561Sveltejs devalue before 5.9.3 proto Rejection Bypass via Property-Key Coercion
- CVE-2026-114063SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
- CVE-2026-114062SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks
- CVE-2026-114061SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
- CVE-2026-114060SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
- CVE-2026-92708devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
- CVE-2026-81176Svelte devalue: DoS via malformed input
- CVE-2026-82261SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
- CVE-2026-82260SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
- CVE-2026-82259SvelteKit 2.49.0 before 2.53.3 Denial of Service via form
- CVE-2026-82258SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch
- CVE-2026-82257SvelteKit before 2.69.1 Prototype Pollution via File Input
- CVE-2026-82256SvelteKit before 2.69.1 Denial of Service via Remote Form
- CVE-2026-66062SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
- CVE-2026-42599Cross-site scripting via spread attributes in Svelte SSR
- CVE-2026-42567Svelte: ReDoS in `<svelte:element>` Tag Validation
- CVE-2026-42573Svelte: XSS via DOM Clobbering of Internal Framework State
- CVE-2026-42570Svelte devalue: DoS via sparse array deserialization
- CVE-2026-40074SvelteKit's invalidated redirect in handle hook causes Denial-of-Service
- CVE-2026-40073SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node
- CVE-2026-30226devalue has prototype pollution in devalue.parse and devalue.unflatten
- CVE-2026-27902Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers