{"uuid": "2b58b75c-ed2f-43e6-9955-22f649ee1814", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "name": "CVEs affecting the Svelte ecosystem", "description": "# CVEs affecting the Svelte ecosystem\nWe\u2019ve released patches for 5 vulnerabilities across `devalue`, `svelte`, `@sveltejs/kit`, and `@sveltejs/adapter-node`. Here\u2019s what you need to know:\n\nUpgrade [now](https://svelte.dev/blog/cves-affecting-the-svelte-ecosystem).\n\nIf you\u2019re using any of these packages, upgrade them to their corresponding non-vulnerable versions:\n\n*   `devalue`: `5.6.2`\n*   `svelte`: `5.46.4`\n*   `@sveltejs/kit`: `2.49.5`\n*   `@sveltejs/adapter-node`: `5.5.1`\n\nFor cross-dependent packages \u2014 `svelte` and `@sveltejs/kit` depend on `devalue` \u2014 patched versions already include upgraded dependencies.\n\nWe\u2019re extremely thankful to all of the security researchers who responsibly disclosed these vulnerabilities and worked with us to get them fixed, to the security team at Vercel who helped us navigate the disclosure process, and to the maintainers who worked to publish the fixes.\n\nOver the last few weeks, we\u2019ve seen a spate of high profile vulnerabilities affecting popular tools across the web development ecosystem. While they are unfortunate, it has been encouraging to see the community pulling together to keep end users safe. Using the lessons learned from these vulnerabilities, we will invest in processes that will help catch future bugs during the writing and review phases, _before_ they go live.\n\nIf you think you have discovered a vulnerability in a package maintained by the Svelte team, we urge you to privately report it via the Security tab on the repo in question (or the [Svelte repo](https://github.com/sveltejs/svelte/security/), if unsure).\n\nDetails[](#Details)\n-------------------\n\nFull reports are available in the published security advisories, but we\u2019ve included a brief summary of each below.\n\n### [CVE-2026-22775](https://github.com/sveltejs/devalue/security/advisories/GHSA-g2pg-6438-jwpf): DoS in devalue.parse due to memory/CPU exhaustion[](#Details-CVE-2026-22775:-DoS-in-devalue.parse-due-to-memory-CPU-exhaustion)\n\n*   Packages affected:\n    *   `devalue`\n*   You\u2019re affected if:\n    *   You\u2019re using `devalue` versions `5.1.0` through `5.6.1`, and\n    *   You\u2019re parsing user-controlled input\n*   Effects:\n    *   A malicious payload can cause arbitrarily large memory allocation, potentially crashing the process\n    *   SvelteKit applications using remote functions are vulnerable, as the parameters are run through `devalue.parse`\n    *   If you don\u2019t have remote functions enabled, SvelteKit is not vulnerable\n\n### [CVE-2026-22774](https://github.com/sveltejs/devalue/security/advisories/GHSA-vw5p-8cq8-m7mv): DoS in devalue.parse due to memory exhaustion[](#Details-CVE-2026-22774:-DoS-in-devalue.parse-due-to-memory-exhaustion)\n\n(Yes, this is very similar to the previous CVE. No, it is not the same!)\n\n*   Packages affected:\n    *   `devalue`\n*   You\u2019re affected if:\n    *   You\u2019re using `devalue` versions `5.3.0` through `5.6.1`, and\n    *   You\u2019re parsing user-controlled input\n*   Effects:\n    *   A malicious payload can cause arbitrarily large memory allocation, potentially crashing the process\n    *   SvelteKit applications using remote functions are vulnerable, as the parameters are run through `devalue.parse`\n    *   If you don\u2019t have remote functions enabled, SvelteKit is not vulnerable\n\n### [CVE-2026-22803](https://github.com/sveltejs/kit/security/advisories/GHSA-j2f3-wq62-6q46): **Memory amplification DoS in Remote Functions binary form deserializer**[](#Details-CVE-2026-22803:-Memory-amplification-DoS-in-Remote-Functions-binary-form-deserializer)\n\n*   Packages affected:\n    *   `@sveltejs/kit`\n*   You\u2019re affected if:\n    *   You\u2019re using SvelteKit versions `2.49.0` through `2.49.4`, and\n    *   You\u2019ve enabled the `experimental.remoteFunctions` flag, and\n    *   You\u2019re using `form`\n*   Effects:\n    *   Users can submit a malicious request that causes your application to hang and allocate arbitrarily-large amounts of memory\n\n### [CVE-2025-67647](https://github.com/sveltejs/kit/security/advisories/GHSA-j62c-4x62-9r35): **Denial of service and possible SSRF when using prerendering**[](#Details-CVE-2025-67647:-Denial-of-service-and-possible-SSRF-when-using-prerendering)\n\n*   Packages affected:\n    *   `@sveltejs/kit`\n    *   `@sveltejs/adapter-node`\n*   You\u2019re vulnerable to DoS if:\n    *   You\u2019re using `@sveltejs/kit` versions `2.44.0` through `2.49.4`, and\n    *   Your app has at least one prerendered route\n*   You\u2019re vulnerable to DoS and SSRF if:\n    *   You\u2019ve using `@sveltejs/kit` versions `2.19.0` through `2.49.4`, and\n    *   Your app has at least one prerendered route, and\n    *   You\u2019re using `@sveltejs/adapter-node` without a configured\u00a0`ORIGIN`\u00a0environment variable, and you are not using a reverse proxy that implements Host header validation\n*   Effects:\n    *   DoS causes the server process to die\n    *   SSRF allows access to internal resources that can be reached without authentication from SvelteKit\u2019s server runtime\n    *   If the stars align, it\u2019s possible to obtain SXSS via cache poisoning by forcing a potential CDN to cache an XSS returned by the attacker\u2019s server (the latter being able to specify the cache-control of their choice)\n\n### [CVE-2025-15265](https://github.com/sveltejs/svelte/security/advisories/GHSA-6738-r8g5-qwp3): XSS via hydratable[](#Details-CVE-2025-15265:-XSS-via-hydratable)\n\n*   Packages affected:\n    *   `svelte`\n*   You\u2019re vulnerable if:\n    *   You\u2019re using `svelte` versions `5.46.0` through `5.46.3`, and\n    *   You\u2019re using [`hydratable`](https://svelte.dev/docs/svelte/hydratable), and you\u2019re passing unsanitized, user-controlled strings in as keys\n*   Effects:\n    *   Your users are vulnerable to XSS if an attacker can manage to get a controlled key into `hydratable` that is then returned to another user", "creation_timestamp": "2026-01-16T05:36:42.269526+00:00", "timestamp": "2026-02-18T14:20:55.695841+00:00", "related_vulnerabilities": ["GHSA-vw5p-8cq8-m7mv", "CVE-2025-15265", "GHSA-g2pg-6438-jwpf", "CVE-2026-22775", "CVE-2026-22803", "GHSA-j2f3-wq62-6q46", "GHSA-6738-r8g5-qwp3", "GHSA-j62c-4x62-9r35", "CVE-2026-22774", "CVE-2025-67647"], "author": {"login": "adulau", "name": "Alexandre Dulaunoy", "uuid": "c933734a-9be8-4142-889e-26e95c752803"}}