Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@sveltejs/adapter-vercel

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3npmAmendedPublished

    Cache poisoning in @sveltejs/adapter-vercel

    CVE-2026-27118 · GHSA-9pq4-5hcf-288c

    Affected
    • npm @sveltejs/adapter-vercel < 6.3.2
    Fixed in
    6.3.2· Vendor fix available
    Issue
    Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users. Successful exploitation requires a victim to visit an attacker-controlled link while authenticated. Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible.

    Recommended action: Upgrade to 6.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →