npm

@sveltejs/kit

17 Total advisories

17 Vulnerabilities

0 Malware

Dependency scanning

Check whether @sveltejs/kit is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

@sveltejs/kit

Vulnerabilities

@sveltejs/kit: `query.batch` cross-talk

SvelteKit: Big remote form function payloads can cause Node process to crash

SvelteKit: Prototype pollution in file input deletion path in remote-function forms

SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)

SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass

@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service

Memory exhaustion in SvelteKit remote form deserialization (experimental only)

CPU exhaustion in SvelteKit remote form deserialization (experimental only)

SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering

@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)

@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params

@sveltejs/kit vulnerable to XSS on dev mode 404 page

@sveltejs/kit has unescaped error message included on error page

Sending a GET or HEAD request with a body crashes SvelteKit

SvelteKit framework has Insufficient CSRF protection for CORS requests

SvelteKit vulnerable to Cross-Site Request Forgery

Browse more npm advisories

Start Securing