{"kind": "product", "path": "vulns/npm/@sveltejs%2Fkit", "name": "@sveltejs/kit", "product": "@sveltejs/kit", "ecosystem": "npm", "items": [{"id": "CVE-2026-114061", "noindex": false, "published": "2026-10-21T00:36:35.456Z", "modified": "2026-10-21T00:36:35.456Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "low", "epss": 0.00213, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-114061", "title": "SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages", "description": "SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv=\"cache-control\"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-27mw-82g8-phjj", "https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-xss-via-cache-control-header-in-prerendered-pages", "https://nvd.nist.gov/vuln/detail/CVE-2026-114061"], "fixes": ["3.0.0"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2026-114060", "noindex": false, "published": "2026-10-21T00:36:34.741Z", "modified": "2026-10-21T15:50:38.726Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "low", "epss": 0.00202, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-114060", "title": "SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions", "description": "SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r", "https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions", "https://nvd.nist.gov/vuln/detail/CVE-2026-114060"], "fixes": ["3.0.0"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2026-82261", "noindex": false, "published": "2026-08-28T10:49:44.323Z", "modified": "2026-10-08T15:25:32.042Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00493, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82261", "title": "SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization", "description": "SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6", "https://www.vulncheck.com/advisories/sveltekit-before-2.52.2-cpu-exhaustion-via-remote-form-deserialization", "https://nvd.nist.gov/vuln/detail/CVE-2026-82261"], "fixes": ["2.52.2"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2026-82260", "noindex": false, "published": "2026-08-28T10:49:43.651Z", "modified": "2026-10-08T15:25:31.482Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00493, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82260", "title": "SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization", "description": "SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcf", "https://www.vulncheck.com/advisories/sveltekit-before-2.52.2-memory-exhaustion-via-remote-form-deserialization", "https://nvd.nist.gov/vuln/detail/CVE-2026-82260"], "fixes": ["2.52.2"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2026-82259", "noindex": false, "published": "2026-08-28T10:49:42.969Z", "modified": "2026-10-08T15:25:30.919Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00533, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82259", "title": "SvelteKit 2.49.0 before 2.53.3 Denial of Service via form", "description": "SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c", "https://www.vulncheck.com/advisories/sveltekit-2.49.0-before-2.53.3-denial-of-service-via-form", "https://nvd.nist.gov/vuln/detail/CVE-2026-82259"], "fixes": ["2.53.3"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2026-82258", "noindex": false, "published": "2026-08-28T10:49:42.085Z", "modified": "2026-10-08T15:25:30.362Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00235, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82258", "title": "SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch", "description": "SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr", "https://www.vulncheck.com/advisories/sveltekit-2.38.0-before-2.60.1-cross-user-data-disclosure-via-query-batch", "https://nvd.nist.gov/vuln/detail/CVE-2026-82258"], "fixes": ["2.60.1"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2026-82257", "noindex": false, "published": "2026-08-28T10:49:41.355Z", "modified": "2026-10-08T15:25:29.825Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00358, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82257", "title": "SvelteKit before 2.69.1 Prototype Pollution via File Input", "description": "SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-866w-xmhq-wj7x", "https://www.vulncheck.com/advisories/sveltekit-before-2.69.1-prototype-pollution-via-file-input", "https://nvd.nist.gov/vuln/detail/CVE-2026-82257"], "fixes": ["2.69.1"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2026-82256", "noindex": false, "published": "2026-08-28T10:49:40.634Z", "modified": "2026-10-08T15:25:29.200Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00423, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82256", "title": "SvelteKit before 2.69.1 Denial of Service via Remote Form", "description": "SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-wqjv-9729-c5q2", "https://www.vulncheck.com/advisories/sveltekit-before-2.69.1-denial-of-service-via-remote-form", "https://nvd.nist.gov/vuln/detail/CVE-2026-82256"], "fixes": ["2.69.1"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2026-66062", "noindex": false, "published": "2026-08-07T16:49:43.853Z", "modified": "2026-08-07T21:02:12.997Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00507, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-66062", "title": "SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header", "description": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68", "https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5", "https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2"], "fixes": ["2.70.2"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2026-40074", "noindex": false, "published": "2026-04-10T16:26:07.068Z", "modified": "2026-04-14T14:17:29.422Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L", "severity": "medium", "epss": 0.00366, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-40074", "title": "SvelteKit's invalidated redirect in handle hook causes Denial-of-Service", "description": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-3f6h-2hrp-w5wx", "https://github.com/sveltejs/kit/commit/10d7b44425c3d9da642eecce373d0c6ef83b4fcd", "https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1"], "fixes": ["2.57.1"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2026-40073", "noindex": false, "published": "2026-04-10T16:24:39.987Z", "modified": "2026-04-13T15:36:57.412Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00536, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-40073", "title": "SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node", "description": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp", "https://github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95", "https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1"], "fixes": ["2.57.1"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2026-22803", "noindex": false, "published": "2026-01-15T18:37:57.831Z", "modified": "2026-01-15T19:06:13.528Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0059, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-22803", "title": "SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer", "description": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-j2f3-wq62-6q46", "https://github.com/sveltejs/kit/commit/8ed8155215b9a74012fecffb942ad9a793b274e5", "https://github.com/sveltejs/kit/releases/tag/@sveltejs%2Fadapter-node@5.5.1"], "fixes": ["2.49.5"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2025-67647", "noindex": false, "published": "2026-01-15T18:33:25.295Z", "modified": "2026-01-15T18:58:01.975Z", "cvss": 8.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:N", "severity": "high", "epss": 0.00517, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-67647", "title": "SvelteKit Denial of service and possible SSRF when using prerendering", "description": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. T", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-j62c-4x62-9r35", "https://github.com/sveltejs/kit/commit/d9ae9b00b14f5574d109f3fd548f960594346226", "https://nvd.nist.gov/vuln/detail/CVE-2025-67647"], "fixes": ["2.49.5"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2025-32388", "noindex": false, "published": "2025-04-15T22:32:06.059Z", "modified": "2025-04-16T13:33:47.383Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00304, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-32388", "title": "SvelteKit allows XSS via tracked search_params", "description": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL. This vulnerability is fixed in 2.20.6.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-6q87-84jw-cjhp", "https://github.com/sveltejs/kit/commit/d3300c6a67908590266c363dba7b0835d9a194cf", "https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.20.6"], "fixes": ["2.20.6"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2024-53261", "noindex": false, "published": "2024-11-25T19:15:28.233Z", "modified": "2024-11-25T20:04:36.967Z", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.0033, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2024-53261", "title": "Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit", "description": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. \"Unsanitized input from *the request URL* flows into `end`, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).\" The files `packages/kit/src/exports/vite/dev/index.js` and `packages/kit/src/exports/vite/utils.js` both contain user controllable data which under specific conditions may flow to dev mode pages. There is little to no expected impact. The Vite development is not exposed to the network by default and even if someone were able to trick a developer into executing an XSS aga", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-rjjv-87mx-6x3h", "https://github.com/sveltejs/kit/commit/d338d4635a7fd947ba5112df6ee632c4a0979438", "https://nvd.nist.gov/vuln/detail/CVE-2024-53261"], "fixes": ["2.8.3"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2024-53262", "noindex": false, "published": "2024-11-25T19:07:20.317Z", "modified": "2024-11-25T20:24:05.750Z", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00484, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2024-53262", "title": "Unescaped error message included on error page in SvelteKit", "description": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors contains placeholders that are replaced without escaping the content first. error.html is the page that is rendered when everything else fails. It can contain the following placeholders: %sveltekit.status% — the HTTP status, and %sveltekit.error.message% — the error message.  This leads to possible injection if an app explicitly creates an error with a message that contains user controlled content. Only applications where user provided input is used in the `Error` message will be vulnerable, so the vast m", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-mh2x-fcqh-fmqv", "https://github.com/sveltejs/kit/commit/134e36343ef57ed7e6e2b3bb9e7f05ad37865794", "https://kit.svelte.dev/docs/errors"], "fixes": ["2.8.3"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2024-23641", "noindex": false, "published": "2024-01-24T16:56:32.392Z", "modified": "2024-11-13T15:09:39.781Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00764, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2024-23641", "title": "Sending a GET or HEAD request with a body crashes SvelteKit", "description": "SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-g5m6-hxpp-fc49", "https://github.com/sveltejs/kit/commit/af34142631c876a7eb62ff81f71e8a3f90dafee9", "https://nvd.nist.gov/vuln/detail/CVE-2024-23641"], "fixes": ["2.4.3"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2023-29008", "noindex": false, "published": "2023-04-06T16:36:50.972Z", "modified": "2025-02-10T16:26:25.826Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00373, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2023-29008", "title": "SvelteKit framework has Insufficient CSRF protection for CORS requests", "description": "The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods.\n\nSvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. The protection is implemented at `kit/src/runtime/server/respond.js`. While the implementation does a sufficient job of mitigating common CSRF attacks, the protection can be bypassed in versions prior to 1.15.2 by simply specifying an upper-cased `Content-Type` header value. The browser will not send uppercase characters, but this check does not block all expected CORS r", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-gv7g-x59x-wf8f", "https://github.com/sveltejs/kit/commit/ba436c6685e751d968a960fbda65f24cf7a82e9f", "https://nvd.nist.gov/vuln/detail/CVE-2023-29008"], "fixes": ["1.15.2"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}, {"id": "CVE-2023-29003", "noindex": false, "published": "2023-04-04T21:20:43.983Z", "modified": "2025-02-10T21:29:13.609Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00557, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2023-29003", "title": "SvelteKit has Insufficient Cross-Site Request Forgery Protection", "description": "SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods.\n\nSvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. While the implementation does a sufficient job in mitigating common CSRF attacks, prior to version 1.15.1, the protection can be bypassed by simply specifying a different `Content-Type` header value.\n\nIf abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operati", "references": ["https://github.com/sveltejs/kit/security/advisories/GHSA-5p75-vc5g-8rv2", "https://github.com/sveltejs/kit/commit/bb2253d51d00aba2e4353952d4fb0dcde6c77123", "https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%401.15.1"], "fixes": ["1.15.1"], "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}]}], "total": 19, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "@sveltejs/kit", "path": "vulns/npm/@sveltejs%2Fkit", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 2, "kev": 0}, "lastmod": "2026-10-21T15:50:38.726Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}