Description
SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted Accept headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible.
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.70.1
- Patched version(s): 2.70.2
References
Could your website be exposed too?
SmartScanner can check your website for SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header - CVE-2026-39411
- axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
- Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
- Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline - CVE-2026-27739
You might also like:
See something that needs correcting? Let us knowUpdated August 07, 2026