Known Vulnerabilities for products from Svelte
Listed below are 19 of the newest known vulnerabilities associated with the vendor "Svelte".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-87995 json | Not Provided | 2026-09-09 | 2026-09-10 | |
| CVE-2026-85601 json | Not Provided | 2026-09-04 | 2026-09-10 | |
| CVE-2026-85600 json | Not Provided | 2026-09-04 | 2026-09-05 | |
| CVE-2026-82261 json | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU ex... | Not Provided | 2026-08-28 | 2026-08-31 |
| CVE-2026-82260 json | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) an... | Not Provided | 2026-08-28 | 2026-08-31 |
| CVE-2026-82259 json | SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental... | Not Provided | 2026-08-28 | 2026-08-31 |
| CVE-2026-82258 json | SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from dif... | Not Provided | 2026-08-28 | 2026-08-31 |
| CVE-2026-82257 json | SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields ... | Not Provided | 2026-08-28 | 2026-08-31 |
| CVE-2026-82256 json | SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node p... | Not Provided | 2026-08-28 | 2026-08-31 |
| CVE-2026-81176 json | Not Provided | 2026-09-16 | 2026-09-17 | |
| CVE-2026-70492 json | Not Provided | 2026-08-04 | 2026-08-05 | |
| CVE-2026-66062 json | Not Provided | 2026-08-07 | 2026-08-07 | |
| CVE-2026-55834 json | Not Provided | 2026-08-28 | 2026-08-28 | |
| CVE-2026-42599 json | Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from u... | Not Provided | 2026-06-09 | 2026-07-23 |
| CVE-2026-42573 json | Not Provided | 2026-06-09 | 2026-07-15 | |
| CVE-2026-42570 json | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. ... | Not Provided | 2026-06-09 | 2026-08-24 |
| CVE-2026-42567 json | Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte... | Not Provided | 2026-06-09 | 2026-07-23 |
| CVE-2026-40074 json | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, ... | Not Provided | 2026-04-10 | 2026-04-15 |
| CVE-2026-40073 json | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under cert... | Not Provided | 2026-04-10 | 2026-04-15 |
| CVE-2026-22775 json | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. ... | Not Provided | 2026-01-15 | 2026-07-15 |