Vendor
Svelte
32 known vulnerabilities in products by Svelte, 0 of them actively exploited (CISA KEV).
Key figures
32
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-82259 | SvelteKit 2.49.0 before 2.53.3 Denial of Service via form | 7.5 | |
| High | CVE-2026-82261 | SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization | 7.5 | |
| High | CVE-2026-82260 | SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization | 7.5 | |
| High | CVE-2021-29261 | Svelte: Code Execution | 7.8 | |
| Critical | CVE-2025-67647 | SvelteKit Denial of service and possible SSRF when using prerendering | 9.1 | |
| High | CVE-2026-40073 | SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node | 7.5 | |
| High | CVE-2026-22803 | SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer | 7.5 | |
| Medium | CVE-2022-25875 | Cross-site Scripting (XSS) | 5.4 | |
| High | CVE-2026-22775 | devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse | 7.5 | |
| High | CVE-2026-22774 | devalue vulnerable to denial of service due to memory exhaustion in devalue.parse | 7.5 | |
| Medium | CVE-2026-82256 | SvelteKit before 2.69.1 Denial of Service via Remote Form | 5.3 | |
| High | CVE-2026-42567 | Svelte: ReDoS in `<svelte:element>` Tag Validation | 7.5 | |
| High | CVE-2024-23641 | Sending a GET or HEAD request with a body crashes SvelteKit | 7.5 | |
| High | CVE-2026-30226 | devalue has prototype pollution in devalue.parse and devalue.unflatten | 7.5 | |
| High | CVE-2026-42570 | Svelte devalue: DoS via sparse array deserialization | 7.5 | |
| High | CVE-2023-29003 | SvelteKit has Insufficient Cross-Site Request Forgery Protection | 8.8 | |
| High | CVE-2026-40074 | SvelteKit's invalidated redirect in handle hook causes Denial-of-Service | 7.5 | |
| Medium | CVE-2026-27125 | Svelte SSR attribute spreading includes inherited properties from prototype chain | 6.8 | |
| Medium | CVE-2026-82257 | SvelteKit before 2.69.1 Prototype Pollution via File Input | 4.3 | |
| Medium | CVE-2026-42573 | Svelte: XSS via DOM Clobbering of Internal Framework State | 6.1 | |
| High | CVE-2023-29008 | SvelteKit framework has Insufficient CSRF protection for CORS requests | 8.8 | |
| Medium | CVE-2026-82258 | SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch | 4.8 | |
| Medium | CVE-2025-15265 | Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR) | 6.1 | |
| Medium | CVE-2024-53262 | Unescaped error message included on error page in SvelteKit | 5.4 | |
| Medium | CVE-2026-42599 | Cross-site scripting via spread attributes in Svelte SSR | 6.1 |
Products
| Svelte | 13 | 0 |
| Svelte Sveltekit | 10 | 0 |
| Svelte Kit | 5 | 0 |
| svelte devalue | 4 | 0 |