EUVD-2026-54557
GHSA-29g2-3rmr-qm68
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable with no privileges or user interaction required; impact is availability-only with partial degradation, matching the ReDoS DoS class and GHSA description.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3Blast Radius
ecosystem impact- 7 npm packages depend on @sveltejs/kit (5 direct, 3 indirect)
Ecosystem-wide dependent count for version 2.70.2.
DescriptionCVE.org
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.
AnalysisAI
Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a specially crafted Accept header, triggering quadratic backtracking in the framework's content negotiation regex and causing excessive CPU consumption. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier remote exploitation against default SvelteKit deployments, though real-world impact is partly mitigated where platform-level header length limits are in place. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Any HTTP request processed by a SvelteKit application running version 2.70.1 or earlier that reaches the `negotiate()` function with an Accept header crafted to lack a MIME-type slash separator can trigger the vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L accurately captures the nature of this flaw: unauthenticated, low-complexity, network-reachable, with impact limited to availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade @sveltejs/kit to version 2.70.2 or later; this is the vendor-confirmed fix as documented in the GitHub Security Advisory GHSA-29g2-3rmr-qm68 and release tag at https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SvelteKit is a web development kit. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authe
SvelteKit 2.19.0-2.49.4 has SSRF/DoS affecting applications with prerendered routes. Can be exploited to make the server
Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who subm
CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers
Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the s
Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads,
SvelteKit versions 2.49.0 through 2.49.4 are vulnerable to denial-of-service attacks through the experimental form remot
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers
SvelteKit versions prior to 2.57.1 are vulnerable to denial of service when the redirect() function is called from the h
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition i
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from Java
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today