Medium
CVE-2026-66062
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 17
Reset filters
Medium
CVE-2026-82257
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
Medium
CVE-2026-82256
SvelteKit: Big remote form function payloads can cause Node process to crash
Medium
CVE-2026-82258
@sveltejs/kit: `query.batch` cross-talk
Medium
CVE-2026-40074
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service
High
CVE-2026-40073
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass
Low
CVE-2026-82259
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)
Medium
CVE-2026-82261
CPU exhaustion in SvelteKit remote form deserialization (experimental only)
Medium
CVE-2026-82260
Memory exhaustion in SvelteKit remote form deserialization (experimental only)
High
CVE-2026-22803
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)
High
CVE-2025-67647
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
Medium
CVE-2025-32388
@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params
Low
CVE-2024-53261
@sveltejs/kit vulnerable to XSS on dev mode 404 page
Low
CVE-2024-53262
@sveltejs/kit has unescaped error message included on error page
High
CVE-2024-23641
Sending a GET or HEAD request with a body crashes SvelteKit
High
CVE-2023-29008
SvelteKit framework has Insufficient CSRF protection for CORS requests
High
CVE-2023-29003
SvelteKit vulnerable to Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.