CVE Tools
Track your stack

Svelte

6 CVEs tracked since 2026. Since Feb 2026, none of them reached CISA KEV.

Svelte CVEs per month

Feb 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Svelte CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-0260
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Svelte's monthly top three, with their CVEs summed over those months.

  1. Svelte61 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Svelte.

  1. CVE-2026-82261SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization7.5
  2. CVE-2026-82260SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization7.5
  3. CVE-2026-82258SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch4.8
  4. CVE-2026-82259SvelteKit 2.49.0 before 2.53.3 Denial of Service via form7.5
  5. CVE-2026-82257SvelteKit before 2.69.1 Prototype Pollution via File Input4.3
  6. CVE-2026-82256SvelteKit before 2.69.1 Denial of Service via Remote Form5.3
  7. CVE-2026-42599Cross-site scripting via spread attributes in Svelte SSR6.1
  8. CVE-2026-42567Svelte: ReDoS in `<svelte:element>` Tag Validation7.5
  9. CVE-2026-42573Svelte: XSS via DOM Clobbering of Internal Framework State6.1
  10. CVE-2026-42570Svelte devalue: DoS via sparse array deserialization7.5
  11. CVE-2026-40074SvelteKit's invalidated redirect in handle hook causes Denial-of-Service7.5
  12. CVE-2026-40073SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node7.5
  13. CVE-2026-30226devalue has prototype pollution in devalue.parse and devalue.unflatten7.5
  14. CVE-2026-27902Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers5.4
  15. CVE-2026-27901Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`6.1

The record

Peak rank
#187 in Feb 2026
Busiest month shown
Feb 2026, 6 CVEs
Months with a KEV entry
0 since Feb 2026
Monthly snapshots
1 since 2026
Svelte's full record, month by month