CVE-2025-67647
Critical · 10.0SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
CVSS
10.0
EPSS
0.5%
Published
Jan 15, 2026
CISA due date
—
The record
Versions of SvelteKit are vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @sveltejs/adapter-node | 5.4.1 | 5.5.1 |
| npm | @sveltejs/kit | 2.19.0 | 2.49.5 |
Related vulnerabilities
- GHSA-j62c-4x62-9r35 SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering Same vulnerability
- GHSA-hgv7-v322-mmgr @sveltejs/kit: `query.batch` cross-talk Also affects @sveltejs/kit
- GHSA-3f6h-2hrp-w5wx @sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service Also affects @sveltejs/kit
- GHSA-2crg-3p73-43xp @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass Also affects @sveltejs/kit
- CVE-2026-40073 SvelteKit is a framework for rapidly developing robust, performant web applications using… Also affects @sveltejs/kit
- CVE-2026-40074 SvelteKit is a framework for rapidly developing robust, performant web applications using… Also affects @sveltejs/kit
- GHSA-fpg4-jhqr-589c SvelteKit has deserialization expansion in unvalidated `form` remote function leading to… Also affects @sveltejs/kit
- GHSA-88qp-p4qg-rqm6 CPU exhaustion in SvelteKit remote form deserialization (experimental only) Also affects @sveltejs/kit