Read the docs

sveltejs

Records51All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high22CVSS 7.0–8.9

Exploited now

sveltejs records in CISA KEV

No sveltejs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Svelte 13 records MEDIUM Sveltekit 10 records HIGH Kit 5 records HIGH Devalue 4 records MEDIUM Adapter-node 2 records HIGH

Records

10 records in Sveltekit · all components

TI-2026-56726 CVE-2026-82261 · GHSA-xjpx-7387-jh7h

SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization

Priority MEDIUM 44

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00493 Published 2026-08-28 Fixed in 2.52.1 CWE-400
TI-2026-56725 CVE-2026-82260 · GHSA-33c7-c62f-7cc2

SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization

Priority MEDIUM 44

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00493 Published 2026-08-28 Fixed in 2.52.1 CWE-400
TI-2026-56724 CVE-2026-82259 · GHSA-7jhg-723h-fjhx

SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

Priority MEDIUM 44

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00533 Published 2026-08-28 Fixed in 2.53.3 CWE-502
TI-2026-56721 CVE-2026-82256 · GHSA-qcf5-5x72-5253

SvelteKit before 2.69.1 Denial of Service via Remote Form

Priority LOW 37

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00423 Published 2026-08-28 Fixed in 2.69.1 CWE-400
TI-2026-56723 CVE-2026-82258 · GHSA-m99x-q38g-c4c6

SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch

Priority LOW 26

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context.

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00235 Published 2026-08-28 Fixed in 2.60.1 CWE-362
TI-2026-56722 CVE-2026-82257 · GHSA-6mgf-42wv-8j7p

SvelteKit before 2.69.1 Prototype Pollution via File Input

Priority LOW 24

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00358 Published 2026-08-28 Fixed in 2.69.1 CWE-1321
Open these records in search →