Vulnerability · Published Aug 7, 2026 · Assigned by GitHub_M

CVE-2026-66062SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

Medium 5.3

In plain English

A medium-severity regular-expression denial of service in kit from sveltejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 56.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@sveltejs/kit	2.70.2	GHSA-29g2-3rmr-qm68

Affected products (as reported)

Vendor	Product	Versions
sveltejs	kit	< 2.70.2

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68 x_refsource_CONFIRM
https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5 x_refsource_MISC
https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2 x_refsource_MISC