Vendor
Sveltejs
56 known vulnerabilities in products by Sveltejs, 0 of them actively exploited (CISA KEV).
Key figures
56
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-92708 | devalue: `stringify`/`uneval` serialize shared memory | 7.5 | |
| High | CVE-2026-114063 | SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows | 7.5 | |
| High | CVE-2026-82259 | SvelteKit 2.49.0 before 2.53.3 Denial of Service via form | 7.5 | |
| High | CVE-2026-123563 | Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse | 7.5 | |
| High | CVE-2026-82261 | SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization | 7.5 | |
| High | CVE-2026-82260 | SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization | 7.5 | |
| High | CVE-2026-123569 | Devalue before 5.6.3 Denial of Service via Sparse Array Serialization | 7.5 | |
| High | CVE-2026-123566 | Devalue before 5.9.3 CPU Amplification Denial of Service via uneval | 7.5 | |
| High | CVE-2026-123565 | Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval | 7.5 | |
| High | CVE-2026-123564 | Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays | 7.5 | |
| High | CVE-2026-123562 | Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection | 7.5 | |
| Critical | CVE-2025-67647 | SvelteKit Denial of service and possible SSRF when using prerendering | 9.1 | |
| High | CVE-2026-40073 | SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node | 7.5 | |
| High | CVE-2026-22803 | SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer | 7.5 | |
| Medium | CVE-2026-114062 | SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks | 5.3 | |
| High | CVE-2026-22775 | devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse | 7.5 | |
| High | CVE-2026-22774 | devalue vulnerable to denial of service due to memory exhaustion in devalue.parse | 7.5 | |
| Medium | CVE-2026-82256 | SvelteKit before 2.69.1 Denial of Service via Remote Form | 5.3 | |
| High | CVE-2026-42567 | Svelte: ReDoS in `<svelte:element>` Tag Validation | 7.5 | |
| High | CVE-2026-128120 | SvelteKit: DoS while parsing form data from a remote functions `form` | 7.5 | |
| High | CVE-2026-128118 | Sveltejs Kit: Exposure of Sensitive Information to an Unauthorized Actor | 7.5 | |
| Medium | CVE-2026-81176 | Svelte devalue: DoS via malformed input | 5.3 | |
| High | CVE-2024-23641 | Sending a GET or HEAD request with a body crashes SvelteKit | 7.5 | |
| High | CVE-2026-30226 | devalue has prototype pollution in devalue.parse and devalue.unflatten | 7.5 | |
| High | CVE-2026-42570 | Svelte devalue: DoS via sparse array deserialization | 7.5 |