Em resumo
- CVE-2026-66062 é uma vulnerabilidade MÉDIO (CVSS 5.3) que afeta @sveltejs/kit.
- Chance de exploração nos próximos 30 dias (EPSS): 0.51%, maior que 43.3% das vulnerabilidades.
- Correção: atualize para 2.70.2 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| @sveltejs/kit npm | < 2.70.2
| 2.70.2
|
Description
Impact
SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted Accept headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible.
Patches
The vulnerability is patched in @sveltejs/kit version 2.70.2.
NVD description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free