CVE-2026-66062
1 advisory.
npm/@sveltejs/kit CVE-2026-66062: medium 5.3, EPSS 0.51%
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
Action: Upgrade @sveltejs/kit to 2.70.2 or later.
npm i @sveltejs/kit@2.70.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.70.2 | - |
Fixed versions
| 2.70.2 |
Sources
- osv: GHSA-29g2-3rmr-qm68
- https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68
- https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5
- https://github.com/sveltejs/kit
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2
CVE-2026-66062 · published · modified · JSON