sveltejs
- Total products in the ecosystem
- 3
- Total vulnerabilities (90 days)
- 21
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, sveltejs recorded 21 security vulnerabilities in the last 90 days across 2 products, including 11 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, devalue had the most security vulnerabilities in the sveltejs ecosystem, with 11 vulnerabilities—approximately 52.38% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-123569Devalue before 5.6.3 Denial of Service via Sparse Array SerializationCVE-2026-123568Sveltejs devalue before 5.6.3 Prototype Pollution via uneval OutputCVE-2026-123567Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflattenCVE-2026-123566Devalue before 5.9.3 CPU Amplification Denial of Service via unevalCVE-2026-123565Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-123569Devalue before 5.6.3 Denial of Service via Sparse Array Serialization | Exploitation statusNot confirmed | FixYes |
| Published11/08/2026 |
| SeverityHigh |
CVE-2026-123568Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output | Exploitation statusNot confirmed | FixYes | Affected productdevalue | Published11/08/2026 | SeverityLow |
|---|
CVE-2026-123567Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten | Exploitation statusNot confirmed | FixYes | Affected productdevalue | Published11/08/2026 | SeverityMedium |
|---|
CVE-2026-123566Devalue before 5.9.3 CPU Amplification Denial of Service via uneval | Exploitation statusNot confirmed | FixYes | Affected productdevalue | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123565Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval | Exploitation statusNot confirmed | FixYes | Affected productdevalue | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123564Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays | Exploitation statusNot confirmed | FixYes | Affected productdevalue | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123563Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse | Exploitation statusNot confirmed | FixYes | Affected productdevalue | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123562Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection | Exploitation statusNot confirmed | FixYes | Affected productdevalue | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123561Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion | Exploitation statusNot confirmed | FixYes | Affected productdevalue | Published11/08/2026 | SeverityMedium |
|---|
CVE-2026-114063SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows | Exploitation statusNot exploited | FixYes | Affected productkit | Published10/21/2026 | SeverityHigh |
|---|
CVE-2026-114062SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks | Exploitation statusNot exploited | FixYes | Affected productkit | Published10/21/2026 | SeverityMedium |
|---|
CVE-2026-114061SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages | Exploitation statusNot exploited | FixYes | Affected productkit | Published10/21/2026 | SeverityLow |
|---|
CVE-2026-114060SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions | Exploitation statusNot exploited | FixYes | Affected productkit | Published10/21/2026 | SeverityLow |
|---|
CVE-2026-92708devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers | Exploitation statusNot exploited | FixYes | Affected productdevalue | Published09/18/2026 | SeverityHigh |
|---|
CVE-2026-81176Svelte devalue: DoS via malformed input | Exploitation statusNot exploited | FixYes | Affected productdevalue | Published09/16/2026 | SeverityMedium |
|---|
CVE-2026-82261SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization | Exploitation statusNot exploited | FixYes | Affected productkit | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-82260SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization | Exploitation statusNot exploited | FixYes | Affected productkit | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-82259SvelteKit 2.49.0 before 2.53.3 Denial of Service via form | Exploitation statusNot exploited | FixYes | Affected productkit | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-82258SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch | Exploitation statusNot exploited | FixYes | Affected productkit | Published08/28/2026 | SeverityMedium |
|---|
CVE-2026-82257SvelteKit before 2.69.1 Prototype Pollution via File Input | Exploitation statusNot exploited | FixYes | Affected productkit | Published08/28/2026 | SeverityMedium |
|---|
CVE-2026-82256SvelteKit before 2.69.1 Denial of Service via Remote Form | Exploitation statusNot exploited | FixYes | Affected productkit | Published08/28/2026 | SeverityMedium |
|---|
CVE-2026-66062SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header | Exploitation statusNot exploited | FixNo | Affected productkit | Published08/07/2026 | SeverityMedium |
|---|
CVE-2026-42599Cross-site scripting via spread attributes in Svelte SSR | Exploitation statusNot exploited | FixYes | Affected productsvelte | Published06/09/2026 | SeverityMedium |
|---|
CVE-2026-42573Svelte: XSS via DOM Clobbering of Internal Framework State | Exploitation statusNot exploited | FixYes | Affected productsvelte | Published06/09/2026 | SeverityMedium |
|---|
CVE-2026-42570Svelte devalue: DoS via sparse array deserialization | Exploitation statusNot exploited | FixYes | Affected productdevalue | Published06/09/2026 | SeverityHigh |
|---|
CVE-2026-42567Svelte: ReDoS in `<svelte:element>` Tag Validation | Exploitation statusNot exploited | FixYes | Affected productsvelte | Published06/09/2026 | SeverityMedium |
|---|
CVE-2026-40074SvelteKit's invalidated redirect in handle hook causes Denial-of-Service | Exploitation statusNot exploited | FixYes | Affected productkit | Published04/10/2026 | SeverityMedium |
|---|
CVE-2026-40073SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node | Exploitation statusNot exploited | FixYes | Affected productkit | Published04/10/2026 | SeverityHigh |
|---|
CVE-2026-30226devalue has prototype pollution in devalue.parse and devalue.unflatten | Exploitation statusNot exploited | FixYes | Affected productdevalue | Published03/11/2026 | SeverityMedium |
|---|
CVE-2026-27902Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers | Exploitation statusNot exploited | FixNo | Affected productsvelte | Published02/26/2026 | SeverityMedium |
|---|
CVE-2026-27901Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` | Exploitation statusNot exploited | FixNo | Affected productsvelte | Published02/26/2026 | SeverityMedium |
|---|
CVE-2026-27125Svelte SSR attribute spreading includes inherited properties from prototype chain | Exploitation statusNot exploited | FixYes | Affected productsvelte | Published02/20/2026 | SeverityMedium |
|---|
CVE-2026-27122Svelte SSR does not validate dynamic element tag names in `<svelte:element>` | Exploitation statusNot exploited | FixYes | Affected productsvelte | Published02/20/2026 | SeverityMedium |
|---|
CVE-2026-27121Svelte affected by cross-site scripting via spread attributes in Svelte SSR | Exploitation statusNot exploited | FixYes | Affected productsvelte | Published02/20/2026 | SeverityMedium |
|---|
CVE-2026-27119Svelte affected by XSS in SSR `<option>` element | Exploitation statusNot exploited | FixYes | Affected productsvelte | Published02/20/2026 | SeverityMedium |
|---|
CVE-2026-27118Cache poisoning in @sveltejs/adapter-vercel | Exploitation statusNot exploited | FixYes | Affected productkit | Published02/20/2026 | SeverityMedium |
|---|
CVE-2026-22803SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer | Exploitation statusNot exploited | FixYes | Affected productkit | Published01/15/2026 | SeverityHigh |
|---|
CVE-2026-22775devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse | Exploitation statusNot exploited | FixYes | Affected productdevalue | Published01/15/2026 | SeverityHigh |
|---|
CVE-2026-22774devalue vulnerable to denial of service due to memory exhaustion in devalue.parse | Exploitation statusNot exploited | FixYes | Affected productdevalue | Published01/15/2026 | SeverityHigh |
|---|
CVE-2025-67647SvelteKit Denial of service and possible SSRF when using prerendering | Exploitation statusNot exploited | FixYes | Affected productkit | Published01/15/2026 | SeverityHigh |
|---|
CVE-2025-57820Svelte devalue vulnerable to prototype pollution | Exploitation statusNot exploited | FixYes | Affected productdevalue | Published08/26/2025 | SeverityHigh |
|---|
CVE-2025-32388SvelteKit allows XSS via tracked search_params | Exploitation statusActively exploited | FixYes | Affected productkit | Published04/15/2025 | SeverityMedium |
|---|
CVE-2024-53262Unescaped error message included on error page in SvelteKit | Exploitation statusNot exploited | FixNo | Affected productkit | Published11/25/2024 | SeverityLow |
|---|
CVE-2024-53261Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit | Exploitation statusNot exploited | FixNo | Affected productkit | Published11/25/2024 | SeverityLow |
|---|
CVE-2024-45047Potential mXSS vulnerability due to improper HTML escaping in svelte | Exploitation statusActively exploited | FixNo | Affected productsvelte | Published08/30/2024 | SeverityMedium |
|---|
CVE-2024-23641Sending a GET or HEAD request with a body crashes SvelteKit | Exploitation statusActively exploited | FixNo | Affected productkit | Published01/24/2024 | SeverityHigh |
|---|
CVE-2023-29008SvelteKit framework has Insufficient CSRF protection for CORS requests | Exploitation statusActively exploited | FixNo | Affected productkit | Published04/06/2023 | SeverityHigh |
|---|
CVE-2023-29003SvelteKit has Insufficient Cross-Site Request Forgery Protection | Exploitation statusActively exploited | FixNo | Affected productkit | Published04/04/2023 | SeverityHigh |
|---|
48 Results | Page 1 of 1