Executive brief
SvelteKit is a popular web framework for building fast, interactive web applications. An attacker can send specially crafted HTTP Accept headers to trigger CPU exhaustion on the server, causing it to become unresponsive and denying service to legitimate users. The vulnerability only affects systems with high or disabled header size limits, as most platforms have default protections in place.
Technical details
SvelteKit contains a ReDoS vulnerability (CWE-1333) in its content negotiation header parsing logic, specifically in the Accept header parser. The vulnerability stems from inefficient regular expression matching that exhibits quadratic backtracking behavior when processing specially crafted Accept header values. An unauthenticated attacker can exploit this by sending HTTP requests with maliciously crafted Accept headers to any SvelteKit application. No authentication or user interaction is required; the attack is triggered automatically during HTTP request processing. A successful exploit consumes CPU resources, potentially rendering the affected service unavailable. The vulnerability is mitigated by default header length limits on most platforms; however, systems with raised or disabled limits are vulnerable. A patch is available in @sveltejs/kit version 2.70.2 and later.
Affected products
- Svelte @sveltejs/kit <2.70.2
Timeline
- 2026-08-07: disclosed: Advisory GHSA-29g2-3rmr-qm68 published
- 2026-07-29: patched: Fix released in @sveltejs/kit version 2.70.2