Ssveltejs

Products

Exploited and recent CVEs

• CVE-2026-114063 High 7.5 SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows 0.4%
• CVE-2026-114062 Medium 5.3 SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks 0.4%
• CVE-2026-114061 Medium 4.7 SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages 0.2%
• CVE-2026-114060 Medium 4.7 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions 0.2%
• CVE-2026-92708 High 7.5 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers 0.7%
• CVE-2026-81176 Medium 5.3 Svelte devalue: DoS via malformed input 0.5%
• CVE-2026-82261 High 7.5 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization 0.5%
• CVE-2026-82260 High 7.5 SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization 0.5%
• CVE-2026-82259 High 7.5 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form 0.5%
• CVE-2026-82258 Medium 5.9 SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch 0.2%
• CVE-2026-82257 Medium 4.3 SvelteKit before 2.69.1 Prototype Pollution via File Input 0.4%
• CVE-2026-82256 Medium 5.3 SvelteKit before 2.69.1 Denial of Service via Remote Form 0.4%
• CVE-2026-66062 Medium 5.3 SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header 0.5%
• CVE-2026-42599 Medium 5.1 Cross-site scripting via spread attributes in Svelte SSR 0.2%
• CVE-2026-42567 Medium 5.9 Svelte: ReDoS in `<svelte:element>` Tag Validation 0.5%
• CVE-2026-42573 High 8.1 Svelte: XSS via DOM Clobbering of Internal Framework State 0.3%
• CVE-2026-42570 High 7.5 Svelte devalue: DoS via sparse array deserialization 0.4%
• CVE-2026-40074 Medium 6.3 SvelteKit's invalidated redirect in handle hook causes Denial-of-Service 0.4%
• CVE-2026-40073 High 8.2 SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node 0.5%
• CVE-2026-30226 Medium 6.3 devalue has prototype pollution in devalue.parse and devalue.unflatten 0.5%
• CVE-2026-27902 Medium 5.3 Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers 0.3%
• CVE-2026-27901 Medium 5.3 Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` 0.3%
• CVE-2026-27125 Medium 5.3 Svelte SSR attribute spreading includes inherited properties from prototype chain 0.4%
• CVE-2026-27122 Medium 5.1 Svelte SSR does not validate dynamic element tag names in `<svelte:element>` 0.2%
• CVE-2026-27121 Medium 5.1 Svelte affected by cross-site scripting via spread attributes in Svelte SSR 0.2%
• CVE-2026-27119 Medium 5.1 Svelte affected by XSS in SSR `<option>` element 0.2%
• CVE-2026-27118 Medium 5.3 Cache poisoning in @sveltejs/adapter-vercel 0.3%
• CVE-2026-22775 High 7.5 devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse 0.6%
• CVE-2026-22774 High 7.5 devalue vulnerable to denial of service due to memory exhaustion in devalue.parse 0.6%
• CVE-2026-22803 High 8.2 SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer 0.6%