@sveltejs/kit
14 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for @sveltejs/kit, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
@sveltejs/kit CVEs per month
| Month | CVEs |
|---|---|
| 2024-11 | 2 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 1 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 2 |
| 2026-02 | 3 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 1 |
| 2026-06 | 0 |
| 2026-07 | 2 |
| 2026-08 | 0 |
| 2026-09 | 0 |
| 2026-10 | 0 |
Severity
How the 14 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High4
- Medium3
Latest CVEs
The 14 most recently published vulnerabilities affecting @sveltejs/kit.
- GHSA-866w-xmhq-wj7xSvelteKit: Prototype pollution in file input deletion path in remote-function forms—
- GHSA-wqjv-9729-c5q2SvelteKit: Big remote form function payloads can cause Node process to crash—
- GHSA-hgv7-v322-mmgr@sveltejs/kit: `query.batch` cross-talk—
- GHSA-fpg4-jhqr-589cSvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)—
- GHSA-88qp-p4qg-rqm6CPU exhaustion in SvelteKit remote form deserialization (experimental only)—
- GHSA-vrhm-gvg7-fpcf Memory exhaustion in SvelteKit remote form deserialization (experimental only)—
- CVE-2026-22803SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer7.5
- CVE-2025-67647SvelteKit Denial of service and possible SSRF when using prerendering9.1
- CVE-2025-32388SvelteKit allows XSS via tracked search_params5.4
- CVE-2024-53261Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit5.4
- CVE-2024-53262Unescaped error message included on error page in SvelteKit5.4
- CVE-2024-23641Sending a GET or HEAD request with a body crashes SvelteKit7.5
- CVE-2023-29008SvelteKit framework has Insufficient CSRF protection for CORS requests8.8
- CVE-2023-29003SvelteKit has Insufficient Cross-Site Request Forgery Protection8.8
Product grouping is registry-driven, with AI assist and human review. How it works