Executive brief
SvelteKit is a web application framework used to build modern JavaScript-based websites. When prerendering is enabled, the framework is vulnerable to denial of service attacks that crash the server and to server-side request forgery (SSRF) that can expose internal services. Attackers can craft malicious requests to terminate the server process or access restricted internal systems without authentication.
Technical details
The vulnerability exists in SvelteKit versions 2.19.0 and later when prerendering is enabled (export const prerender = true). The root cause involves improper validation of the Host header during prerendering in configurations using adapter-node without a configured ORIGIN environment variable and no reverse proxy Host header validation. An attacker on the network can send crafted requests with malicious Host headers to trigger either a denial of service (server crash) or server-side request forgery to access internal services. The SSRF can also lead to stored cross-site scripting (XSS) via cache poisoning if traffic passes through a CDN. SvelteKit 2.49.5 and adapter-node 5.5.1 contain fixes; users should update immediately if using prerendered routes.
Affected products
- Svelte SvelteKit 2.19.0 to 2.49.4
- Svelte adapter-node 5.4.1 to 5.5.0
Timeline
- 2026-01-15: disclosed: Advisory published
- 2026-01-15: patched: SvelteKit 2.49.5 and adapter-node 5.5.1 released with fixes