EUVD-2026-54557
GHSA-29g2-3rmr-qm68
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable with no privileges or user interaction required; impact is availability-only with partial degradation, matching the ReDoS DoS class and GHSA description.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3Blast Radius
ecosystem impact- 7 npm packages depend on @sveltejs/kit (5 direct, 3 indirect)
Ecosystem-wide dependent count for version 2.70.2.
DescriptionCVE.org
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.
AnalysisAI
Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a specially crafted Accept header, triggering quadratic backtracking in the framework's content negotiation regex and causing excessive CPU consumption. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier remote exploitation against default SvelteKit deployments, though real-world impact is partly mitigated where platform-level header length limits are in place. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Technical ContextAI
SvelteKit's request handling uses a negotiate() function in packages/kit/src/utils/http.js to parse content negotiation headers such as Accept. The vulnerable regex - /([^/ ]+)/([^; ]+)[ ]*(?:;[ ]*q=([0-9.]+))?/ - lacked a start anchor (^), causing the JavaScript regex engine to attempt a match at every character position within the input string. When the input is a long string that never satisfies the pattern (e.g., repeated characters without a MIME-type slash separator), the engine backtracks quadratically - O(n²) - with respect to the input length n. This is the canonical ReDoS pattern classified under CWE-1333 (Inefficient Regular Expression Complexity). The fix, confirmed by commit diff, adds a ^ anchor to force a single-pass evaluation. The affected CPE is cpe:2.3:a:sveltejs:kit:*:*:*:*:*:*:*:* covering all kit versions up to and including 2.70.1.
RemediationAI
Upgrade @sveltejs/kit to version 2.70.2 or later; this is the vendor-confirmed fix as documented in the GitHub Security Advisory GHSA-29g2-3rmr-qm68 and release tag at https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2. The patch (https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5) anchors the content negotiation regex with ^, eliminating quadratic backtracking at negligible functional cost. If an immediate upgrade is not possible, configure upstream reverse proxies or load balancers to enforce strict Accept header size limits - for example, nginx's large_client_header_buffers directive or equivalent limits in AWS ALB or Cloudflare; the GHSA advisory identifies this as an existing mitigating factor on most platforms. Note that header size restriction is a compensating control only: a moderately sized malformed header below typical platform limits may still cause measurable CPU impact, so it does not substitute for patching.
SvelteKit is a web development kit. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authe
SvelteKit 2.19.0-2.49.4 has SSRF/DoS affecting applications with prerendered routes. Can be exploited to make the server
Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who subm
CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers
Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the s
Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads,
SvelteKit versions 2.49.0 through 2.49.4 are vulnerable to denial-of-service attacks through the experimental form remot
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers
SvelteKit versions prior to 2.57.1 are vulnerable to denial of service when the redirect() function is called from the h
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition i
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from Java
Unauthenticated broken access control in the Kit (formerly ConvertKit) WordPress plugin versions up to and including 3.3
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today