@sveltejs/kit

3.1.0 · 14 Oct 2026MIT2M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for @sveltejs/kit. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	3.1.0	No known advisory
	2.70.3	Safe from 2.70.2
	1.30.4	16 open advisories, worst high · last release Feb 2024, no longer updated

Your version

High
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypassGHSA-2crg-3p73-43xp · 10 Apr 2026
- 2.x2.0.0 – 2.57.0Fixed in 2.57.1
- 1.x and older0.0.8 – 1.30.4No fix, no longer updated · move to 2.57.1
High
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)GHSA-j2f3-wq62-6q46 · 15 Jan 2026
- 2.x2.49.0 – 2.49.4Fixed in 2.49.5
High
SvelteKit is vulnerable to denial of service and possible SSRF when using prerenderingGHSA-j62c-4x62-9r35 · 15 Jan 2026
- 2.x2.19.0 – 2.49.4Fixed in 2.49.5
High
Sending a GET or HEAD request with a body crashes SvelteKitGHSA-g5m6-hxpp-fc49 · 24 Jan 2024
- 2.x2.0.0 – 2.4.2Fixed in 2.4.3
High
SvelteKit framework has Insufficient CSRF protection for CORS requestsGHSA-gv7g-x59x-wf8f · 7 Apr 2023
- 1.x1.0.0 – 1.15.1Fixed in 1.15.2
- 0.0.x0.0.8 – 0.0.30No fix on 0.0.x · move to 1.15.2
High
SvelteKit vulnerable to Cross-Site Request ForgeryGHSA-5p75-vc5g-8rv2 · 4 Apr 2023
- 1.x1.0.0 – 1.15.0Fixed in 1.15.1
- 0.0.x0.0.8 – 0.0.30No fix on 0.0.x · move to 1.15.1
Moderate
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept headerGHSA-29g2-3rmr-qm68 · 7 Aug 2026
- 2.x2.0.0 – 2.70.1Fixed in 2.70.2
- 1.x and older0.0.8 – 1.30.4No fix, no longer updated · move to 2.70.2
Moderate
SvelteKit: Prototype pollution in file input deletion path in remote-function formsGHSA-866w-xmhq-wj7x · 24 Jul 2026
- 2.x2.0.0 – 2.69.0Fixed in 2.69.1
- 1.x and older0.0.8 – 1.30.4No fix, no longer updated · move to 2.69.1
Moderate
SvelteKit: Big remote form function payloads can cause Node process to crashGHSA-wqjv-9729-c5q2 · 24 Jul 2026
- 2.x2.0.0 – 2.69.0Fixed in 2.69.1
- 1.x and older0.0.8 – 1.30.4No fix, no longer updated · move to 2.69.1
Moderate
@sveltejs/kit: `query.batch` cross-talkGHSA-hgv7-v322-mmgr · 21 May 2026
- 2.x2.38.0 – 2.60.0Fixed in 2.60.1
Moderate
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-ServiceGHSA-3f6h-2hrp-w5wx · 10 Apr 2026
- 2.x2.0.0 – 2.57.0Fixed in 2.57.1
- 1.x and older0.0.8 – 1.30.4No fix, no longer updated · move to 2.57.1
Moderate
CPU exhaustion in SvelteKit remote form deserialization (experimental only)GHSA-88qp-p4qg-rqm6 · 19 Feb 2026
- 2.x2.49.0 – 2.52.0Fixed in 2.52.2
Moderate
Memory exhaustion in SvelteKit remote form deserialization (experimental only)GHSA-vrhm-gvg7-fpcf · 19 Feb 2026
- 2.x2.49.0 – 2.52.0Fixed in 2.52.2
Moderate
@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_paramsGHSA-6q87-84jw-cjhp · 14 Apr 2025
- 2.x2.0.0 – 2.20.5Fixed in 2.20.6
Low
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)GHSA-fpg4-jhqr-589c · 28 Feb 2026
- 2.x2.49.0 – 2.53.2Fixed in 2.53.3
Low
@sveltejs/kit vulnerable to XSS on dev mode 404 pageGHSA-rjjv-87mx-6x3h · 25 Nov 2024
- 2.x2.0.0 – 2.8.2Fixed in 2.8.3
- 1.x and older0.0.8 – 1.30.4No fix, no longer updated · move to 2.8.3
Low
@sveltejs/kit has unescaped error message included on error pageGHSA-mh2x-fcqh-fmqv · 25 Nov 2024
- 2.x2.0.0 – 2.8.2Fixed in 2.8.3
- 1.x and older0.0.8 – 1.30.4No fix, no longer updated · move to 2.8.3

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Licence
MIT
Provenance
Present, built from github.com/sveltejs/kit
Says where the release was built and from which commit. It does not say the code is safe.
Published by
GitHub Actions
Maintainers on npm
rich_harris, svelte-admin, conduitry
Size
1.5 MB unpacked, 246 files
GitHub stars
20,863 on sveltejs/kit
Last release
3.1.0, 14 October 2026
OpenSSF Scorecard
No Scorecard for this repository

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.