---
id: 2026-01-svelte-ecosystem-cve-batch
title: "Five CVEs across the Svelte ecosystem — devalue DoS, SvelteKit memory-amplification DoS, SSRF via prerendering, and a hydratable-key XSS (all patched, backfilled 7 months late)"
date_disclosed: 2026-01-15
last_updated: 2026-01-15
severity: high
status: patched
ecosystems: [npm, javascript, svelte]
tools_affected: ["svelte", "@sveltejs/kit", "@sveltejs/adapter-node", "devalue"]
tags: [dos, memory-exhaustion, ssrf, xss, cve-batch, prerendering]
---

## TL;DR
Svelte's own security blog disclosed **five CVEs** across the Svelte ecosystem on **2026-01-15**: two memory/CPU-exhaustion denial-of-service bugs in `devalue` (the serializer Svelte and SvelteKit depend on for hydration), a memory-amplification DoS in SvelteKit's experimental Remote Functions binary form deserializer, a combined DoS + SSRF bug triggered during prerendering, and a stored XSS via unescaped hydratable keys in Svelte core. All five are patched. This repo's prior Svelte-specific "direct CVE query" rotation (added after catching CVE-2026-42573 in July) had not caught this batch — a 7-month backfill gap, caught this sweep via a direct search rather than the usual query phrasing.

## What happened

Svelte published a single consolidated advisory post ([svelte.dev/blog/cves-affecting-the-svelte-ecosystem](https://svelte.dev/blog/cves-affecting-the-svelte-ecosystem), 2026-01-15) covering:

| CVE | Package | Affected | Description | Patched |
|---|---|---|---|---|
| **CVE-2026-22775** | `devalue` | 5.1.0–5.6.1 | DoS in `devalue.parse` via memory/CPU exhaustion parsing malicious user-controlled input | 5.6.2 |
| **CVE-2026-22774** | `devalue` | 5.3.0–5.6.1 | DoS in `devalue.parse` via memory exhaustion, distinct payload shape from CVE-2026-22775 | 5.6.2 |
| **CVE-2026-22803** | `@sveltejs/kit` | 2.49.0–2.49.4 | Memory-amplification DoS (CWE-789, CVSS 4.0: 8.2) in the experimental Remote Functions **binary form deserializer** — a crafted payload manipulates a size value used for memory allocation, exhausting server memory. Only sites using the experimental Remote Functions feature with form submissions are affected. | 2.49.5 |
| **CVE-2025-67647** | `@sveltejs/kit` (2.19.0–2.49.4) and `@sveltejs/adapter-node` (all versions before 5.5.1) | Combined DoS + SSRF triggered during **prerendering** — the DoS crashes the prerender process; the SSRF component allows unauthorized access to internal network resources | Kit 2.49.5; adapter-node 5.5.1 |
| **CVE-2025-15265** | `svelte` | 5.46.0–5.46.3 | XSS via unsanitized user-controlled strings used as keys in the `hydratable` function, allowing arbitrary JavaScript injection into server-rendered HTML | 5.46.4 |

`devalue` is a transitive dependency of both `svelte` and `@sveltejs/kit`, so the patched versions of Svelte/SvelteKit already pull in the fixed `devalue` release — you don't need to separately bump `devalue` if you upgrade the top-level packages, but confirm your lockfile actually resolved the newer transitive version. Netlify and other hosting providers published their own guidance shortly after disclosure ([Netlify changelog](https://www.netlify.com/changelog/2026-01-15-sveltekit-security-vulnerabilities/)).

## Am I affected?

```bash
npm ls svelte @sveltejs/kit @sveltejs/adapter-node devalue 2>/dev/null
grep -E '"(svelte|@sveltejs/kit|@sveltejs/adapter-node|devalue)":' package.json
```

- `svelte` **5.46.0–5.46.3**: exposed to the hydratable-key XSS (CVE-2025-15265). Upgrade to **≥5.46.4**.
- `@sveltejs/kit` **2.49.0–2.49.4** using the experimental Remote Functions feature with form submissions: exposed to the memory-amplification DoS (CVE-2026-22803). Upgrade to **≥2.49.5**.
- `@sveltejs/kit` **2.19.0–2.49.4** using prerendering: exposed to the DoS/SSRF combination (CVE-2025-67647). Upgrade to **≥2.49.5**.
- `@sveltejs/adapter-node` before **5.5.1**: exposed to the same SSRF (CVE-2025-67647). Upgrade to **≥5.5.1**.
- `devalue` **5.1.0–5.6.1** (directly or transitively): exposed to one or both DoS bugs (CVE-2026-22775 / CVE-2026-22774). Upgrade to **≥5.6.2**.

## If you are affected

1. Upgrade `svelte`, `@sveltejs/kit`, and `@sveltejs/adapter-node` to the patched versions above; confirm `devalue` resolves to ≥5.6.2 in your lockfile.
2. If you use SvelteKit's experimental Remote Functions with form submissions, treat any pre-patch deployment as having been exposed to a DoS primitive — check server logs/uptime around the disclosure window for unexplained memory spikes or crashes.
3. If you prerender pages and expose the build to untrusted trigger input, check for SSRF indicators (unexpected outbound requests to internal network ranges from your build/prerender process).
4. See [playbooks/if-your-webapp-was-compromised.md](../playbooks/if-your-webapp-was-compromised.md) if you find evidence of exploitation predating your patch.

## Prevention
→ [prevention/supply-chain-attack-surface.md](../prevention/supply-chain-attack-surface.md)

## Sources
- [Svelte — CVEs affecting the Svelte ecosystem](https://svelte.dev/blog/cves-affecting-the-svelte-ecosystem) — primary vendor disclosure, published 2026-01-15: all five CVE IDs, affected/patched version ranges, descriptions.
- [Netlify Changelog — 5 SvelteKit security vulnerabilities: what Netlify users need to know](https://www.netlify.com/changelog/2026-01-15-sveltekit-security-vulnerabilities/) — independent corroboration, hosting-provider guidance, published same day.
- [GitLab Advisory Database — @sveltejs/kit CVE-2026-22803](https://advisories.gitlab.com/pkg/npm/@sveltejs/kit/CVE-2026-22803/) — CVE↔package pairing verified directly, CVSS 4.0 8.2, CWE-789.