Read the docs

sveltejs

Records42All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high16CVSS 7.0–8.9

Exploited now

sveltejs records in CISA KEV

No sveltejs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Svelte 13 records MEDIUM Sveltekit 10 records HIGH Kit 5 records HIGH Devalue 4 records MEDIUM Adapter-node 2 records HIGH

Records

42 records

TI-2025-23466 CVE-2025-32388 · GHSA-6q87-84jw-cjhp

SvelteKit allows XSS via tracked search_params

Priority MEDIUM 58

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00304 Published 2025-04-15 Fixed in 2.20.6 CWE-79
TI-2025-13940 CVE-2025-15265 · GHSA-6738-r8g5-qwp3

Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)

Priority MEDIUM 57

An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00346 Published 2026-01-15 Partial fix · 5.46.3, 5.46.4 CWE-79
TI-2026-78676 CVE-2026-114063

Path traversal in SvelteKit vite preview on Windows exposes files

Priority MEDIUM 44

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output director…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00405 Published 2026-10-21 Fixed in 3.0.0 CWE-22
TI-2026-56726 CVE-2026-82261 · GHSA-xjpx-7387-jh7h

SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization

Priority MEDIUM 44

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00493 Published 2026-08-28 Fixed in 2.52.1 CWE-400
TI-2026-56725 CVE-2026-82260 · GHSA-33c7-c62f-7cc2

SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization

Priority MEDIUM 44

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00493 Published 2026-08-28 Fixed in 2.52.1 CWE-400
TI-2026-56724 CVE-2026-82259 · GHSA-7jhg-723h-fjhx

SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

Priority MEDIUM 44

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00533 Published 2026-08-28 Fixed in 2.53.3 CWE-502
TI-2026-30850 CVE-2026-42570 · GHSA-77vg-94rm-hx3p

Svelte devalue: DoS via sparse array deserialization

Priority LOW 39

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00397 Published 2026-06-09 Partial fix · 5.8.1 CWE-770
TI-2026-56721 CVE-2026-82256 · GHSA-qcf5-5x72-5253

SvelteKit before 2.69.1 Denial of Service via Remote Form

Priority LOW 37

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00423 Published 2026-08-28 Fixed in 2.69.1 CWE-400
TI-2026-78675 CVE-2026-114062

Server-side request forgery in SvelteKit self-fetch fallbacks

Priority LOW 36

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00352 Published 2026-10-21 Fixed in 3.0.0 CWE-918
TI-2026-56075 CVE-2026-81176 · GHSA-9rgm-9g3h-6x36

Svelte devalue: DoS via malformed input

Priority LOW 31

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00507 Published 2026-09-16 Partial fix · 5.9.2 CWE-770
TI-2026-21570 CVE-2026-27118 · GHSA-9pq4-5hcf-288c

Cache poisoning in @sveltejs/adapter-vercel

Priority LOW 30

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00276 Published 2026-02-20 Fixed in 6.3.2 CWE-346
Load more
Open these records in search →