# CVE-2026-66062: Svelte SvelteKit ReDoS in Accept header content negotiation

Source: https://junglewise.ai/threats/cve-2026-66062-svelte-sveltekit-redos-in-accept-header-content-negotiation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66062 · Severity: medium · CVSS 5.3 · Published 2026-08-07

SvelteKit is a popular web framework for building fast, interactive web applications. An attacker can send specially crafted HTTP Accept headers to trigger CPU exhaustion on the server, causing it to become unresponsive and denying service to legitimate users. The vulnerability only affects systems with high or disabled header size limits, as most platforms have default protections in place.

Technologies: [@sveltejs/kit (npm)](https://junglewise.ai/threats/technologies/sveltejs-kit), [Svelte Kit](https://junglewise.ai/threats/technologies/kit), [SvelteKit](https://junglewise.ai/threats/technologies/sveltekit). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Svelte](https://junglewise.ai/threats/vendors/svelte).

## Quick answers

**Is CVE-2026-66062 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66062 being exploited in the wild.

**How severe is CVE-2026-66062?** Medium severity, with a CVSS score of 5.3, published 7 August 2026.

**Which products and versions are affected?** @sveltejs/kit (npm) <= 2.70.1, SEMVER:introduced=0,fixed=2.70.2; Svelte Kit <= 2.70.1.

**Is there a fix for CVE-2026-66062?** Yes. @sveltejs/kit (npm): upgrade to 2.70.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66062 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66062?** Check whether you run @sveltejs/kit (npm), Svelte Kit or SvelteKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @sveltejs/kit (npm): upgrade to 2.70.2 or later

  ```sh
  npm install @sveltejs/kit@2.70.2
  ```


## Technical details

SvelteKit contains a ReDoS vulnerability (CWE-1333) in its content negotiation header parsing logic, specifically in the Accept header parser. The vulnerability stems from inefficient regular expression matching that exhibits quadratic backtracking behavior when processing specially crafted Accept header values. An unauthenticated attacker can exploit this by sending HTTP requests with maliciously crafted Accept headers to any SvelteKit application. No authentication or user interaction is required; the attack is triggered automatically during HTTP request processing. A successful exploit consumes CPU resources, potentially rendering the affected service unavailable. The vulnerability is mitigated by default header length limits on most platforms; however, systems with raised or disabled limits are vulnerable. A patch is available in @sveltejs/kit version 2.70.2 and later.

## Affected products

- Svelte @sveltejs/kit <2.70.2

## Identifiers

- CVE-2026-66062
- GHSA-29g2-3rmr-qm68

## Timeline

- 2026-08-07: disclosed: Advisory GHSA-29g2-3rmr-qm68 published
- 2026-07-29: patched: Fix released in @sveltejs/kit version 2.70.2

## References

- [https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68](https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68)
- [https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5](https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5)
- [https://github.com/sveltejs/kit](https://github.com/sveltejs/kit)
- [https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2](https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2)

## Related threats

- [SvelteKit XSS via cache-control header in prerendered pages](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-xss-via-cache-control-header-5731f4e1)
- [SvelteKit open redirect in enhanced form actions](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-open-redirect-via-enhanced-9a8dcd94)
- [SvelteKit path traversal in vite preview server on Windows](https://junglewise.ai/threats/cve-2026-114063-sveltekit-sveltejs-kit-from-2-10-0-before-3-0-0-contains-a-path)
- [SvelteKit server-side request forgery in self-fetch fallbacks](https://junglewise.ai/threats/cve-2026-114062-sveltekit-before-3-0-0-contains-a-server-side-request-forgery)
- [SvelteKit cross-site scripting in prerendered pages](https://junglewise.ai/threats/cve-2026-114061-sveltekit-sveltejs-kit-before-3-0-0-contains-a-cross-site)