CVE Tools
Track your stack

Sveltejs

7 CVEs tracked since 2026. Since Feb 2026, none of them reached CISA KEV.

Sveltejs CVEs per month

Feb 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Sveltejs CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-0270
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Sveltejs's monthly top three, with their CVEs summed over those months.

  1. Svelte61 month
  2. Kit11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Sveltejs.

  1. CVE-2026-114063SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows7.5
  2. CVE-2026-114062SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks5.3
  3. CVE-2026-114061SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages4.7
  4. CVE-2026-114060SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions4.7
  5. CVE-2026-92708devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers7.5
  6. CVE-2026-81176Svelte devalue: DoS via malformed input5.3
  7. CVE-2026-82261SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization7.5
  8. CVE-2026-82260SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization7.5
  9. CVE-2026-82258SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch4.8
  10. CVE-2026-82259SvelteKit 2.49.0 before 2.53.3 Denial of Service via form7.5
  11. CVE-2026-82257SvelteKit before 2.69.1 Prototype Pollution via File Input4.3
  12. CVE-2026-82256SvelteKit before 2.69.1 Denial of Service via Remote Form5.3
  13. CVE-2026-66062SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header5.3
  14. CVE-2026-42599Cross-site scripting via spread attributes in Svelte SSR6.1
  15. CVE-2026-42567Svelte: ReDoS in `<svelte:element>` Tag Validation7.5

The record

Peak rank
#159 in Feb 2026
Busiest month shown
Feb 2026, 7 CVEs
Months with a KEV entry
0 since Feb 2026
Monthly snapshots
1 since 2026
Sveltejs's full record, month by month