Packages / @sveltejs/kit / Security

ModerateVulnerabilityGHSA-hgv7-v322-mmgrCVE-2026-82258Published 21 May 2026

@sveltejs/kit: `query.batch` cross-talk

Affected releases · @sveltejs/kit

  • 2.x2.38.0 – 2.60.0Fixed in 2.60.1

On 2.x, the newest line:

npm install @sveltejs/kit@2.60.1
3.x

  1. Not affected

    3.0.0 – 3.1.0

    3 releases, latest

2.x

  1. Not affected

    2.0.0 – 2.37.1

    150 releases

  2. Affected

    2.38.0 – 2.60.0

    66 releases

  3. Fixed

    2.60.1 – 2.70.3

    21 releases

389 stable releases of @sveltejs/kit, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @sveltejs/kit. It is read in your browser and sent nowhere.

What happens

query.batch() could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.