Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Versions of SvelteKit are vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. Details Affected versions from 2.44.0 onwards are vulnerable to DoS if: - your app has at least one prerendered route (export const prerender = true) Affected versions from 2.19.0 onwards are vulnerable to DoS and SSRF if: - your app has at least one prerendered route (export const prerender = true) - AND you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation Impact The DoS causes the running server process to end. The SSRF allows access to internal services that can be reached without authentication when fetched from SvelteKit's server runtime. It is also possible to obtain an SXSS via cache poisoning, by forcing a potential CDN to cache an XSS returned by the attacker's server (the latter being able to specify the cache-control of their choice).…
Recommended action: Upgrade to 5.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD method cannot have body. and crashes the app. TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. <!-- Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. -- PoC <!-- Complete instructions, including specific configuration details, to reproduce the vulnerability. -- First do a fresh install of SvelteKit 2 with the example app. Typescript. 1. npm run build 2. npm run preview 3. Go to http://localhost:4173 (works) 4. curl -X GET -d "{}" http://localhost:4173/bye 5. Application crashes and http://localhost:4173 is down Impact <!-- What kind of vulnerability is it? Who is impacted? -- Denial of Service for apps using adapter-node
Recommended action: Upgrade to 4.0.1, 3.0.3 or 2.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.