- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, kit recorded 10 security vulnerabilities in the last 90 days, of which 4 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of kit and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-114063SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on WindowsCVE-2026-114062SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch FallbacksCVE-2026-114061SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered PagesCVE-2026-114060SvelteKit before 3.0.0 Open Redirect via Enhanced Form ActionsCVE-2026-82261SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-114063SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-114062SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks | Exploitation statusNot exploited | FixYes | Published10/21/2026 | SeverityMedium |
|---|
CVE-2026-114061SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages | Exploitation statusNot exploited | FixYes | Published10/21/2026 | SeverityLow |
|---|
CVE-2026-114060SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions | Exploitation statusNot exploited | FixYes | Published10/21/2026 | SeverityLow |
|---|
CVE-2026-82261SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization | Exploitation statusNot exploited | FixYes | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-82260SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization | Exploitation statusNot exploited | FixYes | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-82259SvelteKit 2.49.0 before 2.53.3 Denial of Service via form | Exploitation statusNot exploited | FixYes | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-82258SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch | Exploitation statusNot exploited | FixYes | Published08/28/2026 | SeverityMedium |
|---|
CVE-2026-82257SvelteKit before 2.69.1 Prototype Pollution via File Input | Exploitation statusNot exploited | FixYes | Published08/28/2026 | SeverityMedium |
|---|
CVE-2026-82256SvelteKit before 2.69.1 Denial of Service via Remote Form | Exploitation statusNot exploited | FixYes | Published08/28/2026 | SeverityMedium |
|---|
CVE-2026-66062SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header | Exploitation statusNot exploited | FixNo | Published08/07/2026 | SeverityMedium |
|---|
CVE-2026-40074SvelteKit's invalidated redirect in handle hook causes Denial-of-Service | Exploitation statusNot exploited | FixYes | Published04/10/2026 | SeverityMedium |
|---|
CVE-2026-40073SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node | Exploitation statusNot exploited | FixYes | Published04/10/2026 | SeverityHigh |
|---|
CVE-2026-27118Cache poisoning in @sveltejs/adapter-vercel | Exploitation statusNot exploited | FixYes | Published02/20/2026 | SeverityMedium |
|---|
CVE-2026-22803SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer | Exploitation statusNot exploited | FixYes | Published01/15/2026 | SeverityHigh |
|---|
CVE-2025-67647SvelteKit Denial of service and possible SSRF when using prerendering | Exploitation statusNot exploited | FixYes | Published01/15/2026 | SeverityHigh |
|---|
CVE-2025-32388SvelteKit allows XSS via tracked search_params | Exploitation statusActively exploited | FixYes | Published04/15/2025 | SeverityMedium |
|---|
CVE-2024-53262Unescaped error message included on error page in SvelteKit | Exploitation statusNot exploited | FixNo | Published11/25/2024 | SeverityLow |
|---|
CVE-2024-53261Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit | Exploitation statusNot exploited | FixNo | Published11/25/2024 | SeverityLow |
|---|
CVE-2024-23641Sending a GET or HEAD request with a body crashes SvelteKit | Exploitation statusActively exploited | FixNo | Published01/24/2024 | SeverityHigh |
|---|
CVE-2023-29008SvelteKit framework has Insufficient CSRF protection for CORS requests | Exploitation statusActively exploited | FixNo | Published04/06/2023 | SeverityHigh |
|---|
CVE-2023-29003SvelteKit has Insufficient Cross-Site Request Forgery Protection | Exploitation statusActively exploited | FixNo | Published04/04/2023 | SeverityHigh |
|---|
22 Results | Page 1 of 1