SvelteKit CVE-2026-66062

Any HTTP request processed by a SvelteKit application running version 2.70.1 or earlier that reaches the negotiate() function with an Accept header crafted to lack a MIME-type slash separator can trigger the vulnerability. No authentication, session, or special application state is required - the CVSS vector (PR:N, UI:N, AV:N, AC:L) confirms unauthenticated remote exploitation against any reachable SvelteKit instance. Exploitation is limited in practice where the deployment platform enforces header size caps (e.g., nginx defaults cap header values at approximately 8 KB), which bounds the maximum input length and therefore the worst-case CPU cost per request. Applications deployed without header size restrictions, or behind infrastructure with raised or absent limits, face the full impact. There is no non-default configuration requirement - the vulnerable code path is exercised on ordinary content negotiation for any request.

The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L accurately captures the nature of this flaw: unauthenticated, low-complexity, network-reachable, with impact limited to availability. There is no confidentiality or integrity exposure. This is not in CISA KEV, and no standalone POC exploit has been identified, though the attack primitive is trivially constructed from the public advisory and commit diff - any HTTP client capable of setting custom headers is sufficient. The GHSA advisory explicitly notes that default header length limits on most production platforms (reverse proxies, load balancers) significantly constrain the maximum input length and therefore the worst-case backtracking cost, reducing practical severity for well-configured deployments. Organizations running SvelteKit directly exposed without header size controls face the highest real-world risk. Overall this is a genuine but moderate-priority issue: patch promptly, but not an emergency for teams behind standard reverse proxies.

An unauthenticated attacker sends a stream of HTTP requests to any SvelteKit application endpoint, each carrying a crafted Accept header consisting of a long repeated character sequence without a forward-slash (e.g., 'a' repeated thousands of times), which the vulnerable regex attempts to match at every position before failing. Each such request occupies a CPU core for a disproportionately long time; a modest volume of concurrent requests can saturate available CPU and deny service to legitimate users without any authentication or prior access to the application.