What is the CVSS score of CVE-2025-67647?

CVE-2025-67647 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adapter Node are affected by CVE-2025-67647?

Organizations using SvelteKit face critical risk from CVE-2025-67647 rated CVSS 9.1.. A patch is available.

How to fix or mitigate CVE-2025-67647?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Vendor patch is available.

Adapter Node CVE-2025-67647

CRITICAL

Uncaught Exception (CWE-248)

2026-01-15 security-advisories@github.com

GHSA-j62c-4x62-9r35

Denial Of Service Adapter Node Kit

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 21, 2026 - 20:37 nvd

Patch available

CVE Published

Jan 15, 2026 - 19:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. This vulnerability is fixed in 2.49.5.

AnalysisAI

SvelteKit 2.19.0-2.49.4 has SSRF/DoS affecting applications with prerendered routes. Can be exploited to make the server perform arbitrary requests or become unresponsive. Patch available.