Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

sveltejs Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-92708`devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers	Exploitation statusNot confirmed	FixYes	Affected productdevalue	Published09/18/2026	SeverityHigh
`CVE-2026-81176`Svelte devalue: DoS via malformed input	Exploitation statusNot known exploited	FixYes	Affected productdevalue	Published09/16/2026	SeverityMedium
`CVE-2026-82261`SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization	Exploitation statusNot known exploited	FixYes	Affected productkit	Published08/28/2026	SeverityHigh
`CVE-2026-82260`SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization	Exploitation statusNot known exploited	FixYes	Affected productkit	Published08/28/2026	SeverityHigh
`CVE-2026-82259`SvelteKit 2.49.0 before 2.53.3 Denial of Service via form	Exploitation statusNot known exploited	FixYes	Affected productkit	Published08/28/2026	SeverityHigh
`CVE-2026-82258`SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch	Exploitation statusNot known exploited	FixYes	Affected productkit	Published08/28/2026	SeverityMedium
`CVE-2026-82257`SvelteKit before 2.69.1 Prototype Pollution via File Input	Exploitation statusNot known exploited	FixYes	Affected productkit	Published08/28/2026	SeverityMedium
`CVE-2026-82256`SvelteKit before 2.69.1 Denial of Service via Remote Form	Exploitation statusNot known exploited	FixYes	Affected productkit	Published08/28/2026	SeverityMedium
`CVE-2026-66062`SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header	Exploitation statusNot known exploited	FixNot confirmed	Affected productkit	Published08/07/2026	SeverityMedium
`CVE-2026-42599`Cross-site scripting via spread attributes in Svelte SSR	Exploitation statusNot known exploited	FixYes	Affected productsvelte	Published06/09/2026	SeverityMedium
`CVE-2026-42567`Svelte: ReDoS in `<svelte:element>` Tag Validation	Exploitation statusNot known exploited	FixYes	Affected productsvelte	Published06/09/2026	SeverityMedium
`CVE-2026-42573`Svelte: XSS via DOM Clobbering of Internal Framework State	Exploitation statusNot known exploited	FixYes	Affected productsvelte	Published06/09/2026	SeverityMedium
`CVE-2026-42570`Svelte devalue: DoS via sparse array deserialization	Exploitation statusNot known exploited	FixYes	Affected productdevalue	Published06/09/2026	SeverityHigh
`CVE-2026-40074`SvelteKit's invalidated redirect in handle hook causes Denial-of-Service	Exploitation statusNot known exploited	FixYes	Affected productkit	Published04/10/2026	SeverityMedium
`CVE-2026-40073`SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node	Exploitation statusNot known exploited	FixYes	Affected productkit	Published04/10/2026	SeverityHigh
`CVE-2026-30226`devalue has prototype pollution in devalue.parse and devalue.unflatten	Exploitation statusNot known exploited	FixYes	Affected productdevalue	Published03/11/2026	SeverityMedium
`CVE-2026-27902`Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers	Exploitation statusNot known exploited	FixNot confirmed	Affected productsvelte	Published02/26/2026	SeverityMedium
`CVE-2026-27901`Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`	Exploitation statusNot known exploited	FixNot confirmed	Affected productsvelte	Published02/26/2026	SeverityMedium
`CVE-2026-27125`Svelte SSR attribute spreading includes inherited properties from prototype chain	Exploitation statusNot known exploited	FixYes	Affected productsvelte	Published02/20/2026	SeverityMedium
`CVE-2026-27122`Svelte SSR does not validate dynamic element tag names in `<svelte:element>`	Exploitation statusNot known exploited	FixYes	Affected productsvelte	Published02/20/2026	SeverityMedium
`CVE-2026-27121`Svelte affected by cross-site scripting via spread attributes in Svelte SSR	Exploitation statusNot known exploited	FixYes	Affected productsvelte	Published02/20/2026	SeverityMedium
`CVE-2026-27119`Svelte affected by XSS in SSR `<option>` element	Exploitation statusNot known exploited	FixYes	Affected productsvelte	Published02/20/2026	SeverityMedium
`CVE-2026-27118`Cache poisoning in @sveltejs/adapter-vercel	Exploitation statusNot known exploited	FixYes	Affected productkit	Published02/20/2026	SeverityMedium
`CVE-2026-22775`devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse	Exploitation statusNot known exploited	FixYes	Affected productdevalue	Published01/15/2026	SeverityHigh
`CVE-2026-22774`devalue vulnerable to denial of service due to memory exhaustion in devalue.parse	Exploitation statusNot known exploited	FixYes	Affected productdevalue	Published01/15/2026	SeverityHigh
`CVE-2026-22803`SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer	Exploitation statusNot known exploited	FixYes	Affected productkit	Published01/15/2026	SeverityHigh
`CVE-2025-67647`SvelteKit Denial of service and possible SSRF when using prerendering	Exploitation statusNot known exploited	FixYes	Affected productkit	Published01/15/2026	SeverityHigh
`CVE-2025-57820`Svelte devalue vulnerable to prototype pollution	Exploitation statusNot known exploited	FixYes	Affected productdevalue	Published08/26/2025	SeverityHigh
`CVE-2025-32388`SvelteKit allows XSS via tracked search_params	Exploitation statusPublic exploit	FixYes	Affected productkit	Published04/15/2025	SeverityMedium
`CVE-2024-53261`Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit	Exploitation statusNot known exploited	FixNot confirmed	Affected productkit	Published11/25/2024	SeverityLow
`CVE-2024-53262`Unescaped error message included on error page in SvelteKit	Exploitation statusNot known exploited	FixNot confirmed	Affected productkit	Published11/25/2024	SeverityLow
`CVE-2024-45047`Potential mXSS vulnerability due to improper HTML escaping in svelte	Exploitation statusPublic exploit	FixNot confirmed	Affected productsvelte	Published08/30/2024	SeverityMedium
`CVE-2024-23641`Sending a GET or HEAD request with a body crashes SvelteKit	Exploitation statusPublic exploit	FixNot confirmed	Affected productkit	Published01/24/2024	SeverityHigh
`CVE-2023-29008`SvelteKit framework has Insufficient CSRF protection for CORS requests	Exploitation statusPublic exploit	FixNot confirmed	Affected productkit	Published04/06/2023	SeverityHigh
`CVE-2023-29003`SvelteKit has Insufficient Cross-Site Request Forgery Protection	Exploitation statusPublic exploit	FixNot confirmed	Affected productkit	Published04/04/2023	SeverityHigh

35 / 35 Results

All vulnerabilities loaded

Security vulnerabilities from sveltejs

sveltejs

How many security vulnerabilities does sveltejs have?

Which sveltejs product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular sveltejs products

kit

svelte

devalue