# cve.now: Sveltejs The newest entries naming Sveltejs as an affected vendor (up to 200), of 48 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-123569](https://cve.now/CVE-2026-123569.md): Devalue before 5.6.3 Denial of Service via Sparse Array Serialization (CVSS 8.7) - [CVE-2026-123568](https://cve.now/CVE-2026-123568.md): Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output (CVSS 2.1) - [CVE-2026-123567](https://cve.now/CVE-2026-123567.md): Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten (CVSS 6.3) - [CVE-2026-123566](https://cve.now/CVE-2026-123566.md): Devalue before 5.9.3 CPU Amplification Denial of Service via uneval (CVSS 8.7) - [CVE-2026-123565](https://cve.now/CVE-2026-123565.md): Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval (CVSS 8.7) - [CVE-2026-123564](https://cve.now/CVE-2026-123564.md): Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays (CVSS 8.7) - [CVE-2026-123563](https://cve.now/CVE-2026-123563.md): Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse (CVSS 8.7) - [CVE-2026-123562](https://cve.now/CVE-2026-123562.md): Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection (CVSS 8.7) - [CVE-2026-123561](https://cve.now/CVE-2026-123561.md): Sveltejs devalue before 5.9.3 proto Rejection Bypass via Property-Key Coercion (CVSS 6.3) - [CVE-2026-114063](https://cve.now/CVE-2026-114063.md): SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows (CVSS 8.7) - [CVE-2026-114062](https://cve.now/CVE-2026-114062.md): SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks (CVSS 6.9) - [CVE-2026-114061](https://cve.now/CVE-2026-114061.md): SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages (CVSS 2.3) - [CVE-2026-114060](https://cve.now/CVE-2026-114060.md): SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions (CVSS 2.1) - [CVE-2026-92708](https://cve.now/CVE-2026-92708.md): devalue: Cross-request process memory disclosure in devalue when \`stringify\` / \`uneval\` serialize Node Buffers (CVSS 7.5) - [CVE-2026-81176](https://cve.now/CVE-2026-81176.md): Svelte devalue: DoS via malformed input (CVSS 5.3) - [CVE-2026-82261](https://cve.now/CVE-2026-82261.md): SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization (CVSS 8.7) - [CVE-2026-82260](https://cve.now/CVE-2026-82260.md): SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization (CVSS 8.7) - [CVE-2026-82259](https://cve.now/CVE-2026-82259.md): SvelteKit 2.49.0 before 2.53.3 Denial of Service via form (CVSS 8.7) - [CVE-2026-82258](https://cve.now/CVE-2026-82258.md): SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch (CVSS 5.9) - [CVE-2026-82257](https://cve.now/CVE-2026-82257.md): SvelteKit before 2.69.1 Prototype Pollution via File Input (CVSS 5.3) - [CVE-2026-82256](https://cve.now/CVE-2026-82256.md): SvelteKit before 2.69.1 Denial of Service via Remote Form (CVSS 6.9) - [CVE-2026-66062](https://cve.now/CVE-2026-66062.md): SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header (CVSS 5.3) - [CVE-2026-42599](https://cve.now/CVE-2026-42599.md): Cross-site scripting via spread attributes in Svelte SSR (CVSS 5.1) - [CVE-2026-42567](https://cve.now/CVE-2026-42567.md): Svelte: ReDoS in \`\\` Tag Validation (CVSS 5.9) - [CVE-2026-42573](https://cve.now/CVE-2026-42573.md): Svelte: XSS via DOM Clobbering of Internal Framework State (CVSS 5.3) - [CVE-2026-42570](https://cve.now/CVE-2026-42570.md): Svelte devalue: DoS via sparse array deserialization (CVSS 7.5) - [CVE-2026-40074](https://cve.now/CVE-2026-40074.md): SvelteKit's invalidated redirect in handle hook causes Denial-of-Service (CVSS 6.3) - [CVE-2026-40073](https://cve.now/CVE-2026-40073.md): SvelteKit has a BODY\_SIZE\_LIMIT bypass in @sveltejs/adapter-node (CVSS 8.2) - [CVE-2026-30226](https://cve.now/CVE-2026-30226.md): devalue has prototype pollution in devalue.parse and devalue.unflatten (CVSS 6.3) - [CVE-2026-27902](https://cve.now/CVE-2026-27902.md): Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers (CVSS 5.3) - [CVE-2026-27901](https://cve.now/CVE-2026-27901.md): Svelte vulnerable to XSS during SSR with contenteditable \`bind:innerText\` and \`bind:textContent\` (CVSS 5.3) - [CVE-2026-27125](https://cve.now/CVE-2026-27125.md): Svelte SSR attribute spreading includes inherited properties from prototype chain (CVSS 5.3) - [CVE-2026-27122](https://cve.now/CVE-2026-27122.md): Svelte SSR does not validate dynamic element tag names in \`\\` (CVSS 5.1) - [CVE-2026-27121](https://cve.now/CVE-2026-27121.md): Svelte affected by cross-site scripting via spread attributes in Svelte SSR (CVSS 5.1) - [CVE-2026-27119](https://cve.now/CVE-2026-27119.md): Svelte affected by XSS in SSR \`\\` element (CVSS 5.1) - [CVE-2026-27118](https://cve.now/CVE-2026-27118.md): Cache poisoning in @sveltejs/adapter-vercel (CVSS 5.3) - [CVE-2026-22775](https://cve.now/CVE-2026-22775.md): devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse (CVSS 7.5) - [CVE-2026-22774](https://cve.now/CVE-2026-22774.md): devalue vulnerable to denial of service due to memory exhaustion in devalue.parse (CVSS 7.5) - [CVE-2026-22803](https://cve.now/CVE-2026-22803.md): SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer (CVSS 8.2) - [CVE-2025-67647](https://cve.now/CVE-2025-67647.md): SvelteKit Denial of service and possible SSRF when using prerendering (CVSS 8.4) - [CVE-2025-57820](https://cve.now/CVE-2025-57820.md): Svelte devalue vulnerable to prototype pollution (CVSS 7.9) - [CVE-2025-32388](https://cve.now/CVE-2025-32388.md): SvelteKit allows XSS via tracked search\_params (CVSS 5.4) - [CVE-2024-53261](https://cve.now/CVE-2024-53261.md): Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit (CVSS 2.0) - [CVE-2024-53262](https://cve.now/CVE-2024-53262.md): Unescaped error message included on error page in SvelteKit (CVSS 2.0) - [CVE-2024-45047](https://cve.now/CVE-2024-45047.md): Potential mXSS vulnerability due to improper HTML escaping in svelte (CVSS 5.4) - [CVE-2024-23641](https://cve.now/CVE-2024-23641.md): Sending a GET or HEAD request with a body crashes SvelteKit (CVSS 7.5) - [CVE-2023-29008](https://cve.now/CVE-2023-29008.md): SvelteKit framework has Insufficient CSRF protection for CORS requests (CVSS 8.8) - [CVE-2023-29003](https://cve.now/CVE-2023-29003.md): SvelteKit has Insufficient Cross-Site Request Forgery Protection (CVSS 8.8) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/sveltejs Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.