SvelteKit February–July 2026 advisory backfill — nine vendor advisories (three CVSS 8.7 remote-function DoS bugs, a cross-user query.batch data leak, a BODY_SIZE_LIMIT bypass, a ReDoS) that got CVE numbers only on 2026-08-28

View raw markdownEdit on GitHub ↗

TL;DR

Between 2026-02-18 and 2026-07-29 the SvelteKit team published nine security advisories on its own GitHub advisory tab — none announced on the Svelte blog, unlike the January batch this repo already tracks. Six of them received CVE ids from VulnCheck (as CNA) on 2026-08-28, and NVD scores three of the remote-function denial-of-service bugs at CVSS 4.0 8.7 (High) where the vendor labelled them Moderate or Low. One more, a cross-user data leak in query.batch (CVE-2026-82258), is the only confidentiality issue in the set. Everything is fixed: @sveltejs/kit ≥ 2.70.2 closes all nine. If you upgraded after the January CVEs and stopped, you are still on a vulnerable line.

What happened

This repo's January 2026 Svelte batch covered five CVEs the Svelte team announced in a blog post, including CVE-2026-22803 (memory-amplification DoS in the experimental Remote Functions binary form deserializer, fixed 2.49.5). The vendor kept finding bugs in the same deserializer and kept publishing advisories — but only on github.com/sveltejs/kit/security/advisories, with no blog post, and (for most) no CVE at the time. VulnCheck assigned CVEs to six of them in one go on 2026-08-28, which is when they surfaced in this sweep's advisory-database query. Per this repo's standing rule, they are dated here by the vendor's original publication date, not the CVE date.

Vendor advisory (original date) CVE (assigned) Vendor label NVD score Affected @sveltejs/kit Fixed
GHSA-vrhm-gvg7-fpcf (2026-02-18) — memory exhaustion in remote form deserialization CVE-2026-82260 (2026-08-28) Moderate 8.7 High ≥ 2.49.0, ≤ 2.52.1 2.52.2
GHSA-88qp-p4qg-rqm6 (2026-02-18) — CPU exhaustion in remote form deserialization CVE-2026-82261 (2026-08-28) Moderate 8.7 High ≥ 2.49.0, ≤ 2.52.1 2.52.2
GHSA-fpg4-jhqr-589c (2026-02-26) — deserialization expansion in unvalidated form remote function CVE-2026-82259 (2026-08-28) Low 8.7 High 2.49.0 – 2.53.2 2.53.3
GHSA-2crg-3p73-43xp (2026-04-09) — BODY_SIZE_LIMIT bypass on adapter-node CVE-2026-40073 (2026-04-10) Moderate 6.3 8.2 High ≤ 2.57.0 (adapter-node deployments) 2.57.1
GHSA-3f6h-2hrp-w5wx (2026-04-09) — unvalidated redirect() in handle hook throws unhandled TypeError CVE-2026-40074 Moderate 6.3 — ≤ 2.57.0 2.57.1
GHSA-hgv7-v322-mmgr (2026-05-14) — query.batch cross-talk CVE-2026-82258 (2026-08-28) Moderate 5.9 5.9 Medium ≥ 2.38.0, ≤ 2.60.0 2.60.1
GHSA-wqjv-9729-c5q2 (2026-07-02) — big remote form payloads crash the Node process CVE-2026-82256 (2026-08-28) Moderate 6.9 Medium < 2.69.1 2.69.1
GHSA-866w-xmhq-wj7x (2026-07-02) — prototype pollution in file-input deletion path CVE-2026-82257 (2026-08-28) Moderate 5.3 Medium < 2.69.1 2.69.1
GHSA-29g2-3rmr-qm68 (2026-07-29) — ReDoS in content-negotiation Accept header parsing CVE-2026-66062 Moderate 5.3 — < 2.70.1 (page states patched 2.70.2) 2.70.2

Details worth knowing:

  • The three 8.7s are all the same feature. experimental.remoteFunctions with the form remote function deserialises attacker-supplied form data; malformed input exhausts memory (82260), CPU (82261), or — if the app processes the files array without validating files.length or per-file size — expands a small request into a very large file array (82259). Only apps that opted into the experimental feature are exposed, but that is exactly the feature SvelteKit's own docs push for new apps, and the fix version moved three times (2.49.5 → 2.52.2 → 2.53.3) as new variants were found.
  • query.batch cross-talk is a data leak, not a DoS. Under specific timing, concurrent requests from different users could be merged into one request context, so one user could see another's data. Reported by rafabd1; fixed in 2.60.1. If you use query.batch() on anything user-scoped, this is the one to check logs for.
  • BODY_SIZE_LIMIT bypass lets requests exceed the configured body limit on adapter-node deployments. The vendor's own note: limits enforced at a WAF, gateway or platform layer are unaffected — so this matters most for the "one Node process on a VPS" deployments vibe-coding platforms emit.
  • Severity disagreement, again. The vendor labelled 82259 Low and 82260/82261 Moderate; VulnCheck scored all three 8.7 and NVD carries that. This repo's standing rule (prefer the numeric score when a vendor's qualitative label and a CNA's CVSS disagree) is why this advisory is high.
  • Two GHSA ids per CVE. For 82259/82260/82261 the vendor-repo advisories (GHSA-fpg4-jhqr-589c, GHSA-vrhm-gvg7-fpcf, GHSA-88qp-p4qg-rqm6) and the GitHub Advisory Database's separate, "unreviewed" VulnCheck-sourced entries (GHSA-7jhg-723h-fjhx, GHSA-33c7-c62f-7cc2, GHSA-xjpx-7387-jh7h) carry different ids for the same bugs. Grep for the CVE, not the GHSA.
  • No Svelte blog post. svelte.dev/blog has no security post between the January CVE roundup and 2026-09-14; the August and September posts are the SvelteKit 3 release candidate and a "what's new." The advisory tab is the only vendor record.

Am I affected?

npm ls @sveltejs/kit @sveltejs/adapter-node 2>/dev/null
grep -rn 'remoteFunctions' svelte.config.* 2>/dev/null     # experimental feature on?
grep -rn 'query.batch' src/ 2>/dev/null                     # cross-user leak surface
  • @sveltejs/kit < 2.70.2 → affected by at least one item above. 2.52.2 / 2.53.3 / 2.57.1 / 2.60.1 / 2.69.1 / 2.70.2 are the successive fix lines; the last covers everything.
  • Apps that never enabled experimental.remoteFunctions are not exposed to the three 8.7s or the two 2.69.1 items, but are still exposed to the BODY_SIZE_LIMIT bypass (adapter-node), the redirect() DoS, the query.batch leak and the ReDoS.

If you are affected

  1. npm install @sveltejs/kit@latest (≥ 2.70.2) and redeploy; if you are on the SvelteKit 3 release candidate, confirm it is at or past the equivalent fixes before assuming.
  2. If you use query.batch() with per-user data and ran ≥ 2.38.0 < 2.60.1 in production, review access logs for the affected window; this is the one item with a confidentiality impact.
  3. Add files.length and per-file size validation to any form remote function regardless of version — the fix caps the deserializer, not your handler.
  4. → playbooks/if-your-webapp-was-compromised.md if you find evidence of exploitation.

Prevention

→ prevention/supply-chain-attack-surface.md → Watch github.com/sveltejs/kit/security/advisories directly. The January batch got a blog post; the next nine advisories did not, and six of them had no CVE for up to six months — a CVE-driven scanner would have shown a clean bill for the whole period.

Update — 2026-10-06: four more SvelteKit advisories published 2026-10-05, all fixed in 3.0.0 — server-side self-fetch fallbacks followed redirects, so a request whose origin the attacker controls could be bounced into an internal service (GHSA-prjg-x2qj-wj3g, SSRF, 5.3); vite preview on Windows read files outside the output directory (GHSA-xgrj-p7pg-6vm3, Moderate, ≥ 2.10.0); plus a redirect-to-untrusted-site via enhanced form submission and an XSS through an untrusted cache-control header on prerendered pages (both Low)

The tab (fetched 2026-10-06) shows four entries dated 2026-10-05, none with a CVE:

  • GHSA-prjg-x2qj-wj3g — Moderate 5.3, < 3.0.0. SvelteKit makes server-side fallback requests "to URLs derived from incoming request origins" when serving prerendered data, rerouted content, static resources and same-origin subrequests; it followed HTTP redirects on those, so "an attacker-controlled server [could] redirect the request to an internal service." Exposure depends on the adapter: adapter-node deployments that derive the origin from unvalidated Host / forwarded headers are the case the advisory names. 3.0.0 stops following redirects on these self-fetches; the vendor's configuration advice is a fixed trusted origin via paths.origin or a reverse proxy that validates allowed hosts. Remediation Rich-Harris.
  • GHSA-xgrj-p7pg-6vm3 — Moderate, ≥ 2.10.0, no CVSS shown. The preview server (vite preview) on Windows let a network-adjacent attacker read files outside the intended output directory — "application source code, configuration, or credentials." Production and non-Windows unaffected; interim advice is to keep the preview server on localhost and off tunnels. Reporter GekkoQuest. This is the SvelteKit sibling of the Vite dev-server file reads in 2026-04-vite-dev-server-file-read, on the preview rather than the dev server.
  • GHSA-pfhg-q3qv-9q6r (Low; URL redirection to an untrusted site via enhanced form submission) and GHSA-27mw-82g8-phjj (Low; XSS via an untrusted cache-control header in a prerendered page) — listed from the tab, not opened.

Fix line: the "2.70.2 covers everything" statement above was true for the February–July set; for these four it is @sveltejs/kit 3.0.0 (npm latest 3.0.1 on 2026-10-06), a major. Projects that cannot take the major should apply the configuration mitigations for the two moderates — pin paths.origin, keep preview local — which remove the preconditions.

Sources