@sveltejs/kit (npm)
Advisories
21
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.0.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install @sveltejs/kit@3.0.0yarn
yarn add @sveltejs/kit@3.0.0pnpm
pnpm add @sveltejs/kit@3.0.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-pvhg-7v4p-f5q9 Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions Withdrawn |
Medium | all versions | No fix yet |
| GHSA-85pr-xr59-r75h Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages Withdrawn |
Medium | all versions | No fix yet |
| GHSA-27mw-82g8-phjj SvelteKit : XSS via untrusted cache-control header in prerendered page |
Low EPSS 0.21% |
< 3.0.0 | 3.0.0 |
| GHSA-pfhg-q3qv-9q6r SvelteKit: URL redirection to untrusted site via enhanced form submission |
Medium EPSS 0.20% |
< 3.0.0 | 3.0.0 |
| GHSA-29g2-3rmr-qm68 SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header |
Medium EPSS 0.51% |
< 2.70.2 | 2.70.2 |
| GHSA-866w-xmhq-wj7x SvelteKit: Prototype pollution in file input deletion path in remote-function forms |
Medium EPSS 0.36% |
< 2.69.1 | 2.69.1 |
| GHSA-wqjv-9729-c5q2 SvelteKit: Big remote form function payloads can cause Node process to crash |
Medium EPSS 0.42% |
< 2.69.1 | 2.69.1 |
| GHSA-hgv7-v322-mmgr @sveltejs/kit: `query.batch` cross-talk |
Medium EPSS 0.24% |
>= 2.38.0, < 2.60.1 | 2.60.1 |
| GHSA-3f6h-2hrp-w5wx @sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service |
High EPSS 0.37% |
< 2.57.1 | 2.57.1 |
| GHSA-2crg-3p73-43xp @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass |
High EPSS 0.54% |
< 2.57.1 | 2.57.1 |
| GHSA-fpg4-jhqr-589c SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only) |
High EPSS 0.53% |
>= 2.49.0, < 2.53.3 | 2.53.3 |
| GHSA-88qp-p4qg-rqm6 CPU exhaustion in SvelteKit remote form deserialization (experimental only) |
High EPSS 0.49% |
>= 2.49.0, < 2.52.2 | 2.52.2 |
| GHSA-vrhm-gvg7-fpcf Memory exhaustion in SvelteKit remote form deserialization (experimental only) |
High EPSS 0.49% |
>= 2.49.0, < 2.52.2 | 2.52.2 |
| GHSA-j2f3-wq62-6q46 @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata) |
High EPSS 0.59% |
>= 2.49.0, < 2.49.5 | 2.49.5 |
| GHSA-j62c-4x62-9r35 SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering |
Critical EPSS 0.52% |
>= 2.19.0, < 2.49.5 | 2.49.5 |
| GHSA-6q87-84jw-cjhp @sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params |
Medium EPSS 0.30% |
>= 2.0.0, < 2.20.6 | 2.20.6 |
| GHSA-rjjv-87mx-6x3h @sveltejs/kit vulnerable to XSS on dev mode 404 page |
Low EPSS 0.33% |
< 2.8.3 | 2.8.3 |
| GHSA-mh2x-fcqh-fmqv @sveltejs/kit has unescaped error message included on error page |
Medium EPSS 0.48% |
< 2.8.3 | 2.8.3 |
| GHSA-g5m6-hxpp-fc49 Sending a GET or HEAD request with a body crashes SvelteKit |
High EPSS 0.76% |
>= 2.0.0, < 2.4.3 | 2.4.3 |
| GHSA-gv7g-x59x-wf8f SvelteKit framework has Insufficient CSRF protection for CORS requests |
High EPSS 0.37% |
< 1.15.2 | 1.15.2 |
| GHSA-5p75-vc5g-8rv2 SvelteKit vulnerable to Cross-Site Request Forgery |
High EPSS 0.56% |
< 1.15.1 | 1.15.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor