CVE-2026-66062

Summary

SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

Severity

medium

CVSS

5.3

EPSS

0.5% (p43)

CWE

CWE-1333

Also known as

GHSA-29g2-3rmr-qm68

Published

2026-08-07

Updated

2026-08-07

Advisory details

Impact

SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted Accept headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible.

Patches

The vulnerability is patched in @sveltejs/kit version 2.70.2.

References

• https://github.com/advisories/GHSA-29g2-3rmr-qm68
• https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68
• https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2

Related advisories

• CVE-2026-40073 — high · npm/@sveltejs/kit
• GHSA-866w-xmhq-wj7x — medium · npm/@sveltejs/kit
• GHSA-wqjv-9729-c5q2 — medium · npm/@sveltejs/kit
• GHSA-hgv7-v322-mmgr — medium · npm/@sveltejs/kit
• CVE-2026-40074 — medium · npm/@sveltejs/kit
• CVE-2026-52778 — critical · Packagist/yeswiki/yeswiki
• CVE-2026-106104 — high · npm/quasar
• CVE-2026-105854 — high · npm/payload

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity