Sveltejs
Monthly
The npm package devalue (all versions through 5.6.2) can exhaust CPU and memory when it serializes a true sparse array through its uneval or stringify functions, producing a denial of service wherever such an array reaches a server-side serialization call. Practical exploitability is low despite the 8.7 CVSS 4.0 base score: JSON and form/query encodings cannot express an array with holes, so the sparse array must first be constructed by server-side application logic the attacker can influence, which is why our independent assessment scores the issue AC:H. No public exploit code has been identified at time of analysis, and the flaw is fixed in 5.6.3.
Denial of service in Svelte devalue through 5.9.2 can let remote, unauthenticated attackers block the Node.js event loop by routing attacker-influenced sparse arrays into uneval(), which performs synchronous work proportional to the array's declared length rather than its actual contents. The vendor describes exploitation as very difficult because attacker-controlled creation of sparse arrays is hard, and the independent assessment reflects that with AC:H and availability-only impact. Vendor-released patch: 5.9.3; no public exploit was identified at time of analysis and no CISA KEV entry is present in the supplied data.
Memory and CPU exhaustion in Svelte devalue through 5.9.2 can occur when an application parses attacker-controlled data with devalue and then passes the parsed value to uneval; repeated primitive strings cause quadratic expansion, turning a small payload into a very large serialized string. The impact is availability-only (CWE-400/CWE-409), and the trigger is constrained because the deployed application must contain that parse-then-uneval round trip on untrusted input, so this is not a default-configuration remote denial of service. The vendor fixed the package in devalue 5.9.3; no public exploit identified at time of analysis.
Denial of service in the npm package devalue 5.8.0 through 5.9.2 lets a rejected internal promise from stringifyAsync go unhandled, so Node.js can terminate the process even when the caller catches the returned promise. Unauthenticated remote attackers can only trigger this if the application serializes multiple promises at once and lets untrusted input influence the timing or failure of those asynchronous values; the vendor describes exploitation as essentially impossible and far more likely to appear as a developer-introduced bug. There is no confidentiality or integrity impact - the only outcome is availability loss - and no public exploit has been identified at time of analysis.
A path traversal vulnerability in SvelteKit's Vite preview server on Windows (versions 2.10.0 before 3.0.0) allows remote attackers to read files outside the prerendered output directory, potentially exposing source code, configuration, or credentials readable by the server process. Exploitation requires the `vite preview` server to be running on a Windows host and reachable over the network or via a tunnel - a non-default posture, since the preview server is normally bound to localhost. Production deployments using adapter-node or static adapters, and hosts running POSIX/Linux/macOS, are not affected; no public exploit code has been identified at time of analysis, and impact is confined to confidentiality (no integrity or availability effect).
Serialization of Node.js Buffer objects in the JavaScript library devalue 5.1.0 through 5.9.2 leaks unrelated process memory: when stringify, stringifyAsync, or uneval encounters a Buffer, it emits the view's entire backing ArrayBuffer instead of only the visible bytes, and because small Buffers are carved from Node's process-wide shared allocation pool, the serialized output can include up to roughly 64 KB of memory belonging to other in-flight requests. Any server-side-rendered application that serializes a Buffer into HTML without authentication - a SvelteKit or Nuxt page whose load() returns a small Buffer or reads a small file - can therefore publish another user's request body or Authorization header in a public response, and the flaw triggers on every such render because it occurs during serialization rather than parsing, so the library's parse/unflatten prototype-pollution and denial-of-service guards provide no protection. Unauthenticated remote attackers need no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), the affected CPE is cpe:2.3:a:sveltejs:devalue:*, and no public exploit code or confirmed active exploitation was identified at time of analysis.
CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers to render affected servers unresponsive by submitting malformed form data, resulting in denial of service. Versions 2.49.0 through 2.52.1 of @sveltejs/kit are affected, but only when both the experimental.remoteFunctions and form features are simultaneously enabled - a non-default, opt-in configuration. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects the complete availability impact against network-reachable endpoints with no authentication barrier once the experimental features are active.
Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the server process by sending malformed form data to a remote function endpoint, resulting in complete denial of service. Exploitation is gated behind two simultaneous non-default opt-in conditions - the experimental.remoteFunctions flag and form usage - which significantly narrows the real-world attack surface relative to the CVSS 4.0 score of 8.7. No public exploit or CISA KEV listing has been identified; a vendor-released patch is available in version 2.52.2.
Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who submit crafted multipart form requests that exploit a deserialization expansion flaw in the experimental `form` remote function, causing the server to construct disproportionately large `files` arrays and exhaust processing resources. Exploitation is gated behind a non-default opt-in flag (`experimental.remoteFunctions: true`) and requires the application to process the `files` array without length or size validation, substantially narrowing real-world exposure despite the CVSS 4.0 score of 8.7. No public exploit has been identified at time of analysis and the vulnerability does not appear in the CISA KEV catalog.
Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads, causing denial of service through resource exhaustion. Affects SvelteKit versions prior to 2.57.1 running adapter-node. Exploitation requires specific timing conditions (CVSS AT:P). Platform-level and WAF body size limits remain effective. No public exploit identified at time of analysis. Vulnerability exploits CWE-770 resource allocation flaw where BODY_SIZE_LIMIT enforcement fails under race conditions or specific request patterns.
The npm package devalue (sveltejs) through 5.9.2 can be induced by crafted serialized payloads to produce objects carrying a __proto__ own property, an incomplete fix for GHSA-mwv9-gp5h-frr4. By the vendor's own statement this does not by itself cause prototype pollution - it mirrors native JSON.parse behavior - so any real impact depends on how downstream code handles the parsed object; the assessed impact is limited integrity only (I:L, no confidentiality or availability effect). Exploitation requires an application to pass attacker-controlled data to devalue's parse function; no public exploit code or active exploitation is identified, and the vendor ships a fix in 5.9.3.
Server-side request forgery in SvelteKit before 3.0.0 allows unauthenticated remote attackers to abuse the framework's server-side self-fetch fallback as a redirect-following proxy, reaching internal services by influencing Host or forwarded headers. Exploitation requires that the application uses self-fetch fallbacks and that the attacker can control Host or X-Forwarded-Host/-Proto values, which is realistic behind a misconfigured or trusting reverse proxy; the resulting impact depends on which internal services are network-reachable. No public exploit identified at time of analysis, and the vendor-released fix is SvelteKit 3.0.0.
SvelteKit (@sveltejs/kit) versions before 3.0.0 can emit attacker-influenceable HTML or JavaScript into prerendered pages when an application passes untrusted data into a cache-control header via setHeaders; the value is inserted unescaped into a <meta http-equiv="cache-control"> tag. Exploitation requires a prerendered page plus an untrusted header value at prerender/build time, and the injected payload executes only when a user later visits that page (UI:P/UI:R), so impact is confined to the victim's browser context. This is a low-severity XSS issue (CVSS 2.3; assessed CVSS:3.1 vector with C:L/I:L), with no public exploit identified at time of analysis and no CISA KEV confirmation.
SvelteKit (@sveltejs/kit) before 3.0.0 can send a victim's browser to an attacker-controlled site when an enhanced form action (use:enhance) accepts an action path beginning with // and a non-redirect form result is used for navigation. The issue is a client-side open redirect (CWE-601) requiring a crafted link or form action plus victim interaction, and it does not compromise the SvelteKit server or expose application data; only off-site navigation is possible. No public exploit code was identified at time of analysis, and the CVSS v4 score is 2.1.
Quadratic-complexity denial of service in the Svelte devalue JavaScript deserializer (all versions prior to 5.9.2) lets remote attackers stall Node/browser consuming processes by feeding a crafted serialized string to devalue.parse. Because the parser fails to reject indices greater than or equal to values.length in src/parse.js, a payload can alternate between array representations and force work that grows quadratically with payload size; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms this is unauthenticated and requires no user interaction, with impact limited to availability. Exploitation is deployment-conditional: the target application must actually call devalue.parse (or unflatten) on untrusted input - a library that only round-trips trusted internal data is not exposed regardless of version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS data was not provided; the issue is fixed by rejecting out-of-bounds indices in version 5.9.2.
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition in the query.batch() API that can cause concurrent HTTP requests from different authenticated users to merge under a single shared request context. Successful exploitation allows one user to receive response data belonging to another user's simultaneous session, including potentially sensitive application state. Vendor-released patch version 2.60.1 is available; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from JavaScript object prototypes by supplying crafted, user-controlled file input path names. Affected versions are all @sveltejs/kit releases up to and including 2.69.0; the vendor released a fix in 2.69.1. No active exploitation is documented in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is network-reachable and requires no authentication from the attacker.
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers to crash the underlying Node.js process by submitting oversized POST payloads. All @sveltejs/kit versions prior to 2.69.1 are affected; no authentication or special configuration is required to trigger the crash. Repeated exploitation can sustain denial-of-service against the application process; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a specially crafted Accept header, triggering quadratic backtracking in the framework's content negotiation regex and causing excessive CPU consumption. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier remote exploitation against default SvelteKit deployments, though real-world impact is partly mitigated where platform-level header length limits are in place. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
SvelteKit versions prior to 2.57.1 are vulnerable to denial of service when the redirect() function is called from the handle server hook with HTTP header-invalid characters in the location parameter. An unauthenticated remote attacker can trigger an unhandled TypeError by supplying unsanitized user input to the redirect location, potentially causing application crashes on certain platforms. The vulnerability is fixed in version 2.57.1.
The npm package devalue (all versions through 5.6.2) can exhaust CPU and memory when it serializes a true sparse array through its uneval or stringify functions, producing a denial of service wherever such an array reaches a server-side serialization call. Practical exploitability is low despite the 8.7 CVSS 4.0 base score: JSON and form/query encodings cannot express an array with holes, so the sparse array must first be constructed by server-side application logic the attacker can influence, which is why our independent assessment scores the issue AC:H. No public exploit code has been identified at time of analysis, and the flaw is fixed in 5.6.3.
Denial of service in Svelte devalue through 5.9.2 can let remote, unauthenticated attackers block the Node.js event loop by routing attacker-influenced sparse arrays into uneval(), which performs synchronous work proportional to the array's declared length rather than its actual contents. The vendor describes exploitation as very difficult because attacker-controlled creation of sparse arrays is hard, and the independent assessment reflects that with AC:H and availability-only impact. Vendor-released patch: 5.9.3; no public exploit was identified at time of analysis and no CISA KEV entry is present in the supplied data.
Memory and CPU exhaustion in Svelte devalue through 5.9.2 can occur when an application parses attacker-controlled data with devalue and then passes the parsed value to uneval; repeated primitive strings cause quadratic expansion, turning a small payload into a very large serialized string. The impact is availability-only (CWE-400/CWE-409), and the trigger is constrained because the deployed application must contain that parse-then-uneval round trip on untrusted input, so this is not a default-configuration remote denial of service. The vendor fixed the package in devalue 5.9.3; no public exploit identified at time of analysis.
Denial of service in the npm package devalue 5.8.0 through 5.9.2 lets a rejected internal promise from stringifyAsync go unhandled, so Node.js can terminate the process even when the caller catches the returned promise. Unauthenticated remote attackers can only trigger this if the application serializes multiple promises at once and lets untrusted input influence the timing or failure of those asynchronous values; the vendor describes exploitation as essentially impossible and far more likely to appear as a developer-introduced bug. There is no confidentiality or integrity impact - the only outcome is availability loss - and no public exploit has been identified at time of analysis.
A path traversal vulnerability in SvelteKit's Vite preview server on Windows (versions 2.10.0 before 3.0.0) allows remote attackers to read files outside the prerendered output directory, potentially exposing source code, configuration, or credentials readable by the server process. Exploitation requires the `vite preview` server to be running on a Windows host and reachable over the network or via a tunnel - a non-default posture, since the preview server is normally bound to localhost. Production deployments using adapter-node or static adapters, and hosts running POSIX/Linux/macOS, are not affected; no public exploit code has been identified at time of analysis, and impact is confined to confidentiality (no integrity or availability effect).
Serialization of Node.js Buffer objects in the JavaScript library devalue 5.1.0 through 5.9.2 leaks unrelated process memory: when stringify, stringifyAsync, or uneval encounters a Buffer, it emits the view's entire backing ArrayBuffer instead of only the visible bytes, and because small Buffers are carved from Node's process-wide shared allocation pool, the serialized output can include up to roughly 64 KB of memory belonging to other in-flight requests. Any server-side-rendered application that serializes a Buffer into HTML without authentication - a SvelteKit or Nuxt page whose load() returns a small Buffer or reads a small file - can therefore publish another user's request body or Authorization header in a public response, and the flaw triggers on every such render because it occurs during serialization rather than parsing, so the library's parse/unflatten prototype-pollution and denial-of-service guards provide no protection. Unauthenticated remote attackers need no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), the affected CPE is cpe:2.3:a:sveltejs:devalue:*, and no public exploit code or confirmed active exploitation was identified at time of analysis.
CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers to render affected servers unresponsive by submitting malformed form data, resulting in denial of service. Versions 2.49.0 through 2.52.1 of @sveltejs/kit are affected, but only when both the experimental.remoteFunctions and form features are simultaneously enabled - a non-default, opt-in configuration. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects the complete availability impact against network-reachable endpoints with no authentication barrier once the experimental features are active.
Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the server process by sending malformed form data to a remote function endpoint, resulting in complete denial of service. Exploitation is gated behind two simultaneous non-default opt-in conditions - the experimental.remoteFunctions flag and form usage - which significantly narrows the real-world attack surface relative to the CVSS 4.0 score of 8.7. No public exploit or CISA KEV listing has been identified; a vendor-released patch is available in version 2.52.2.
Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who submit crafted multipart form requests that exploit a deserialization expansion flaw in the experimental `form` remote function, causing the server to construct disproportionately large `files` arrays and exhaust processing resources. Exploitation is gated behind a non-default opt-in flag (`experimental.remoteFunctions: true`) and requires the application to process the `files` array without length or size validation, substantially narrowing real-world exposure despite the CVSS 4.0 score of 8.7. No public exploit has been identified at time of analysis and the vulnerability does not appear in the CISA KEV catalog.
Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads, causing denial of service through resource exhaustion. Affects SvelteKit versions prior to 2.57.1 running adapter-node. Exploitation requires specific timing conditions (CVSS AT:P). Platform-level and WAF body size limits remain effective. No public exploit identified at time of analysis. Vulnerability exploits CWE-770 resource allocation flaw where BODY_SIZE_LIMIT enforcement fails under race conditions or specific request patterns.
The npm package devalue (sveltejs) through 5.9.2 can be induced by crafted serialized payloads to produce objects carrying a __proto__ own property, an incomplete fix for GHSA-mwv9-gp5h-frr4. By the vendor's own statement this does not by itself cause prototype pollution - it mirrors native JSON.parse behavior - so any real impact depends on how downstream code handles the parsed object; the assessed impact is limited integrity only (I:L, no confidentiality or availability effect). Exploitation requires an application to pass attacker-controlled data to devalue's parse function; no public exploit code or active exploitation is identified, and the vendor ships a fix in 5.9.3.
Server-side request forgery in SvelteKit before 3.0.0 allows unauthenticated remote attackers to abuse the framework's server-side self-fetch fallback as a redirect-following proxy, reaching internal services by influencing Host or forwarded headers. Exploitation requires that the application uses self-fetch fallbacks and that the attacker can control Host or X-Forwarded-Host/-Proto values, which is realistic behind a misconfigured or trusting reverse proxy; the resulting impact depends on which internal services are network-reachable. No public exploit identified at time of analysis, and the vendor-released fix is SvelteKit 3.0.0.
SvelteKit (@sveltejs/kit) versions before 3.0.0 can emit attacker-influenceable HTML or JavaScript into prerendered pages when an application passes untrusted data into a cache-control header via setHeaders; the value is inserted unescaped into a <meta http-equiv="cache-control"> tag. Exploitation requires a prerendered page plus an untrusted header value at prerender/build time, and the injected payload executes only when a user later visits that page (UI:P/UI:R), so impact is confined to the victim's browser context. This is a low-severity XSS issue (CVSS 2.3; assessed CVSS:3.1 vector with C:L/I:L), with no public exploit identified at time of analysis and no CISA KEV confirmation.
SvelteKit (@sveltejs/kit) before 3.0.0 can send a victim's browser to an attacker-controlled site when an enhanced form action (use:enhance) accepts an action path beginning with // and a non-redirect form result is used for navigation. The issue is a client-side open redirect (CWE-601) requiring a crafted link or form action plus victim interaction, and it does not compromise the SvelteKit server or expose application data; only off-site navigation is possible. No public exploit code was identified at time of analysis, and the CVSS v4 score is 2.1.
Quadratic-complexity denial of service in the Svelte devalue JavaScript deserializer (all versions prior to 5.9.2) lets remote attackers stall Node/browser consuming processes by feeding a crafted serialized string to devalue.parse. Because the parser fails to reject indices greater than or equal to values.length in src/parse.js, a payload can alternate between array representations and force work that grows quadratically with payload size; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms this is unauthenticated and requires no user interaction, with impact limited to availability. Exploitation is deployment-conditional: the target application must actually call devalue.parse (or unflatten) on untrusted input - a library that only round-trips trusted internal data is not exposed regardless of version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS data was not provided; the issue is fixed by rejecting out-of-bounds indices in version 5.9.2.
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition in the query.batch() API that can cause concurrent HTTP requests from different authenticated users to merge under a single shared request context. Successful exploitation allows one user to receive response data belonging to another user's simultaneous session, including potentially sensitive application state. Vendor-released patch version 2.60.1 is available; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from JavaScript object prototypes by supplying crafted, user-controlled file input path names. Affected versions are all @sveltejs/kit releases up to and including 2.69.0; the vendor released a fix in 2.69.1. No active exploitation is documented in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is network-reachable and requires no authentication from the attacker.
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers to crash the underlying Node.js process by submitting oversized POST payloads. All @sveltejs/kit versions prior to 2.69.1 are affected; no authentication or special configuration is required to trigger the crash. Repeated exploitation can sustain denial-of-service against the application process; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a specially crafted Accept header, triggering quadratic backtracking in the framework's content negotiation regex and causing excessive CPU consumption. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier remote exploitation against default SvelteKit deployments, though real-world impact is partly mitigated where platform-level header length limits are in place. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
SvelteKit versions prior to 2.57.1 are vulnerable to denial of service when the redirect() function is called from the handle server hook with HTTP header-invalid characters in the location parameter. An unauthenticated remote attacker can trigger an unhandled TypeError by supplying unsanitized user input to the redirect location, potentially causing application crashes on certain platforms. The vulnerability is fixed in version 2.57.1.