Description
The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods.
SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. The protection is implemented at kit/src/runtime/server/respond.js.
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.15.2
- Patched version(s): 1.15.2
References
Could your website be exposed too?
SmartScanner can check your website for SvelteKit framework has Insufficient CSRF protection for CORS requests and gives you actionable findings to investigate.
Start a free scanRelated Issues
- RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests - CVE-2026-39371
- Payload has a CSRF Protection Bypass in Authentication Flow - CVE-2026-34749
- SvelteKit vulnerable to Cross-Site Request Forgery - CVE-2023-29003
- Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
You might also like:
See something that needs correcting? Let us knowUpdated April 14, 2023