SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

Description

SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted Accept headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible.

Recommendation

Update the @sveltejs/kit package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.70.1
• Patched version(s): 2.70.2

References

• GHSA-29g2-3rmr-qm68
• CVE-2026-66062
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header - CVE-2026-39411
• axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
• Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
• Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline - CVE-2026-27739

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@sveltejs/kit