CVE-2025-67647: SvelteKit denial of service and SSRF in prerendering

CVE-2025-67647 · Severity: medium · CVSS 4 · Published 2026-01-15

SvelteKit is a web application framework used to build modern JavaScript-based websites. When prerendering is enabled, the framework is vulnerable to denial of service attacks that crash the server and to server-side request forgery (SSRF) that can expose internal services. Attackers can craft malicious requests to terminate the server process or access restricted internal systems without authentication.

Technologies: @sveltejs/kit (npm), SvelteKit. Vendors: npm, Svelte.

Quick answers

Is CVE-2025-67647 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-67647 being exploited in the wild.
How severe is CVE-2025-67647?
Medium severity, with a CVSS score of 4, published 15 January 2026.
Which products and versions are affected?
@sveltejs/adapter-node (npm) SEMVER:introduced=5.4.1,fixed=5.5.1; @sveltejs/kit (npm) SEMVER:introduced=2.19.0,fixed=2.49.5; Svelte Adapter-Node 5.4.1 to 5.5.0; SvelteKit 2.19.0 to 2.49.4.
Is there a fix for CVE-2025-67647?
Yes. @sveltejs/adapter-node (npm): upgrade to 5.5.1 or later; @sveltejs/kit (npm): upgrade to 2.49.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-67647 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-67647?
Check whether you run @sveltejs/adapter-node (npm), @sveltejs/kit (npm), Svelte Adapter-Node or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @sveltejs/adapter-node (npm): upgrade to 5.5.1 or later
    npm install @sveltejs/adapter-node@5.5.1
  • @sveltejs/kit (npm): upgrade to 2.49.5 or later
    npm install @sveltejs/kit@2.49.5

Technical details

The vulnerability exists in SvelteKit versions 2.19.0 and later when prerendering is enabled (export const prerender = true). The root cause involves improper validation of the Host header during prerendering in configurations using adapter-node without a configured ORIGIN environment variable and no reverse proxy Host header validation. An attacker on the network can send crafted requests with malicious Host headers to trigger either a denial of service (server crash) or server-side request forgery to access internal services. The SSRF can also lead to stored cross-site scripting (XSS) via cache poisoning if traffic passes through a CDN. SvelteKit 2.49.5 and adapter-node 5.5.1 contain fixes; users should update immediately if using prerendered routes.

Affected products

  • Svelte SvelteKit 2.19.0 to 2.49.4
  • Svelte adapter-node 5.4.1 to 5.5.0

Identifiers

  • CVE-2025-67647
  • GHSA-j62c-4x62-9r35

Timeline

  • 2026-01-15: disclosed: Advisory published
  • 2026-01-15: patched: SvelteKit 2.49.5 and adapter-node 5.5.1 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.