# CVE-2025-67647: SvelteKit denial of service and SSRF in prerendering

Source: https://junglewise.ai/threats/cve-2025-67647-sveltekit-denial-of-service-and-ssrf-in-prerendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-67647 · Severity: medium · CVSS 4 · Published 2026-01-15

SvelteKit is a web application framework used to build modern JavaScript-based websites. When prerendering is enabled, the framework is vulnerable to denial of service attacks that crash the server and to server-side request forgery (SSRF) that can expose internal services. Attackers can craft malicious requests to terminate the server process or access restricted internal systems without authentication.

Technologies: [@sveltejs/kit (npm)](https://junglewise.ai/threats/technologies/sveltejs-kit), [SvelteKit](https://junglewise.ai/threats/technologies/sveltekit). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Svelte](https://junglewise.ai/threats/vendors/svelte).

## Quick answers

**Is CVE-2025-67647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67647 being exploited in the wild.

**How severe is CVE-2025-67647?** Medium severity, with a CVSS score of 4, published 15 January 2026.

**Which products and versions are affected?** @sveltejs/adapter-node (npm) SEMVER:introduced=5.4.1,fixed=5.5.1; @sveltejs/kit (npm) SEMVER:introduced=2.19.0,fixed=2.49.5; Svelte Adapter-Node 5.4.1 to 5.5.0; SvelteKit 2.19.0 to 2.49.4.

**Is there a fix for CVE-2025-67647?** Yes. @sveltejs/adapter-node (npm): upgrade to 5.5.1 or later; @sveltejs/kit (npm): upgrade to 2.49.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-67647 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-67647?** Check whether you run @sveltejs/adapter-node (npm), @sveltejs/kit (npm), Svelte Adapter-Node or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @sveltejs/adapter-node (npm): upgrade to 5.5.1 or later

  ```sh
  npm install @sveltejs/adapter-node@5.5.1
  ```

- @sveltejs/kit (npm): upgrade to 2.49.5 or later

  ```sh
  npm install @sveltejs/kit@2.49.5
  ```


## Technical details

The vulnerability exists in SvelteKit versions 2.19.0 and later when prerendering is enabled (export const prerender = true). The root cause involves improper validation of the Host header during prerendering in configurations using adapter-node without a configured ORIGIN environment variable and no reverse proxy Host header validation. An attacker on the network can send crafted requests with malicious Host headers to trigger either a denial of service (server crash) or server-side request forgery to access internal services. The SSRF can also lead to stored cross-site scripting (XSS) via cache poisoning if traffic passes through a CDN. SvelteKit 2.49.5 and adapter-node 5.5.1 contain fixes; users should update immediately if using prerendered routes.

## Affected products

- Svelte SvelteKit 2.19.0 to 2.49.4
- Svelte adapter-node 5.4.1 to 5.5.0

## Identifiers

- CVE-2025-67647
- GHSA-j62c-4x62-9r35

## Timeline

- 2026-01-15: disclosed: Advisory published
- 2026-01-15: patched: SvelteKit 2.49.5 and adapter-node 5.5.1 released with fixes

## References

- [https://github.com/sveltejs/kit/security/advisories/GHSA-j62c-4x62-9r35](https://github.com/sveltejs/kit/security/advisories/GHSA-j62c-4x62-9r35)

## Related threats

- [SvelteKit XSS via cache-control header in prerendered pages](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-xss-via-cache-control-header-5731f4e1)
- [SvelteKit open redirect in enhanced form actions](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-open-redirect-via-enhanced-9a8dcd94)
- [SvelteKit path traversal in vite preview server on Windows](https://junglewise.ai/threats/cve-2026-114063-sveltekit-sveltejs-kit-from-2-10-0-before-3-0-0-contains-a-path)
- [SvelteKit server-side request forgery in self-fetch fallbacks](https://junglewise.ai/threats/cve-2026-114062-sveltekit-before-3-0-0-contains-a-server-side-request-forgery)
- [SvelteKit cross-site scripting in prerendered pages](https://junglewise.ai/threats/cve-2026-114061-sveltekit-sveltejs-kit-before-3-0-0-contains-a-cross-site)