Five CVEs across the Svelte ecosystem — devalue DoS, SvelteKit memory-amplification DoS, SSRF via prerendering, and a hydratable-key XSS (all patched, backfilled 7 months late)

View raw markdownEdit on GitHub ↗

TL;DR

Svelte's own security blog disclosed five CVEs across the Svelte ecosystem on 2026-01-15: two memory/CPU-exhaustion denial-of-service bugs in devalue (the serializer Svelte and SvelteKit depend on for hydration), a memory-amplification DoS in SvelteKit's experimental Remote Functions binary form deserializer, a combined DoS + SSRF bug triggered during prerendering, and a stored XSS via unescaped hydratable keys in Svelte core. All five are patched. This repo's prior Svelte-specific "direct CVE query" rotation (added after catching CVE-2026-42573 in July) had not caught this batch — a 7-month backfill gap, caught this sweep via a direct search rather than the usual query phrasing.

What happened

Svelte published a single consolidated advisory post (svelte.dev/blog/cves-affecting-the-svelte-ecosystem, 2026-01-15) covering:

CVE Package Affected Description Patched
CVE-2026-22775 devalue 5.1.0–5.6.1 DoS in devalue.parse via memory/CPU exhaustion parsing malicious user-controlled input 5.6.2
CVE-2026-22774 devalue 5.3.0–5.6.1 DoS in devalue.parse via memory exhaustion, distinct payload shape from CVE-2026-22775 5.6.2
CVE-2026-22803 @sveltejs/kit 2.49.0–2.49.4 Memory-amplification DoS (CWE-789, CVSS 4.0: 8.2) in the experimental Remote Functions binary form deserializer — a crafted payload manipulates a size value used for memory allocation, exhausting server memory. Only sites using the experimental Remote Functions feature with form submissions are affected. 2.49.5
CVE-2025-67647 @sveltejs/kit (2.19.0–2.49.4) and @sveltejs/adapter-node (all versions before 5.5.1) Combined DoS + SSRF triggered during prerendering — the DoS crashes the prerender process; the SSRF component allows unauthorized access to internal network resources Kit 2.49.5; adapter-node 5.5.1
CVE-2025-15265 svelte 5.46.0–5.46.3 XSS via unsanitized user-controlled strings used as keys in the hydratable function, allowing arbitrary JavaScript injection into server-rendered HTML 5.46.4

devalue is a transitive dependency of both svelte and @sveltejs/kit, so the patched versions of Svelte/SvelteKit already pull in the fixed devalue release — you don't need to separately bump devalue if you upgrade the top-level packages, but confirm your lockfile actually resolved the newer transitive version. Netlify and other hosting providers published their own guidance shortly after disclosure (Netlify changelog).

Am I affected?

npm ls svelte @sveltejs/kit @sveltejs/adapter-node devalue 2>/dev/null
grep -E '"(svelte|@sveltejs/kit|@sveltejs/adapter-node|devalue)":' package.json
  • svelte 5.46.0–5.46.3: exposed to the hydratable-key XSS (CVE-2025-15265). Upgrade to ≥5.46.4.
  • @sveltejs/kit 2.49.0–2.49.4 using the experimental Remote Functions feature with form submissions: exposed to the memory-amplification DoS (CVE-2026-22803). Upgrade to ≥2.49.5.
  • @sveltejs/kit 2.19.0–2.49.4 using prerendering: exposed to the DoS/SSRF combination (CVE-2025-67647). Upgrade to ≥2.49.5.
  • @sveltejs/adapter-node before 5.5.1: exposed to the same SSRF (CVE-2025-67647). Upgrade to ≥5.5.1.
  • devalue 5.1.0–5.6.1 (directly or transitively): exposed to one or both DoS bugs (CVE-2026-22775 / CVE-2026-22774). Upgrade to ≥5.6.2.

If you are affected

  1. Upgrade svelte, @sveltejs/kit, and @sveltejs/adapter-node to the patched versions above; confirm devalue resolves to ≥5.6.2 in your lockfile.
  2. If you use SvelteKit's experimental Remote Functions with form submissions, treat any pre-patch deployment as having been exposed to a DoS primitive — check server logs/uptime around the disclosure window for unexplained memory spikes or crashes.
  3. If you prerender pages and expose the build to untrusted trigger input, check for SSRF indicators (unexpected outbound requests to internal network ranges from your build/prerender process).
  4. See playbooks/if-your-webapp-was-compromised.md if you find evidence of exploitation predating your patch.

Prevention

→ prevention/supply-chain-attack-surface.md

Sources