Security: sveltejs/kit
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
ReDoS in SvelteKit content negotiation header parsingGHSA-29g2-3rmr-qm68 published
Jul 29, 2026 by elliott-with-the-longest-name-on-githubModerate -
Big remote form function payloads can cause Node process to crashGHSA-wqjv-9729-c5q2 published
Jul 2, 2026 by dummdidummModerate -
Prototype pollution in file input deletion path in remote-function formsGHSA-866w-xmhq-wj7x published
Jul 2, 2026 by dummdidummModerate -
`query.batch` cross-talkGHSA-hgv7-v322-mmgr published
May 14, 2026 by elliott-with-the-longest-name-on-githubModerate -
Unvalidated redirect in handle hook causes Denial-of-ServiceGHSA-3f6h-2hrp-w5wx published
Apr 9, 2026 by elliott-with-the-longest-name-on-githubModerate -
BODY_SIZE_LIMIT bypass in @sveltejs/adapter-nodeGHSA-2crg-3p73-43xp published
Apr 9, 2026 by elliott-with-the-longest-name-on-githubModerate -
Deserialization expansion in unvalidated SvelteKit `form` remote function leads to denial of service (experimental only)GHSA-fpg4-jhqr-589c published
Feb 26, 2026 by elliott-with-the-longest-name-on-githubLow -
Memory exhaustion in SvelteKit remote form deserialization (experimental only)GHSA-vrhm-gvg7-fpcf published
Feb 18, 2026 by elliott-with-the-longest-name-on-githubModerate -
Cache poisoning in @sveltejs/adapter-vercelGHSA-9pq4-5hcf-288c published
Feb 18, 2026 by elliott-with-the-longest-name-on-githubModerate -
CPU exhaustion in SvelteKit remote form deserialization (experimental only)GHSA-88qp-p4qg-rqm6 published
Feb 18, 2026 by elliott-with-the-longest-name-on-githubModerate