Packages / @sveltejs/kit / Security

ModerateVulnerabilityGHSA-29g2-3rmr-qm68CVE-2026-66062Published 7 Aug 2026

SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

Affected releases · @sveltejs/kit

  • 2.x2.0.0 – 2.70.1Fixed in 2.70.2
  • 1.x and older0.0.8 – 1.30.4No fix, no longer updated

On 2.x, the newest line:

npm install @sveltejs/kit@2.70.2
3.x

  1. Not affected

    3.0.0 – 3.1.0

    3 releases, latest

2.x

  1. Affected

    2.0.0 – 2.70.1

    235 releases

  2. Fixed

    2.70.2 – 2.70.3

    2 releases

1.x

  1. Affected

    1.0.0 – 1.30.4

    128 releases

0.x

  1. Affected

    0.0.8 – 0.0.30

    21 releases

389 stable releases of @sveltejs/kit, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @sveltejs/kit. It is read in your browser and sent nowhere.

What happens

Impact

SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted Accept headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible.

Patches

The vulnerability is patched in @sveltejs/kit version 2.70.2.