Is CVE-2026-82258 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82258 being exploited in the wild.

How severe is CVE-2026-82258?

Medium severity, with a CVSS score of 4.8, published 28 August 2026.

Which products and versions are affected?

@sveltejs/kit (npm) SEMVER:introduced=2.38.0,fixed=2.60.1.

Is there a fix for CVE-2026-82258?

Yes. @sveltejs/kit (npm): upgrade to 2.60.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82258 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82258?

Check whether you run @sveltejs/kit (npm) or SvelteKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82258: SvelteJS Kit query.batch cross-talk vulnerability

CVE-2026-82258 · Severity: medium · CVSS 4.8 · Published 2026-08-28

Svelte Kit is a web application framework that handles request batching for performance. Under rare timing conditions, the query.batch feature could cause concurrent requests from different users to merge into a single context, allowing one user to see another user's private data. This is a cross-user data disclosure vulnerability requiring very specific timing conditions but affecting production deployments.

Technologies: @sveltejs/kit (npm), SvelteKit. Vendors: npm, Svelte.

Quick answers

Is CVE-2026-82258 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82258 being exploited in the wild.
How severe is CVE-2026-82258?: Medium severity, with a CVSS score of 4.8, published 28 August 2026.
Which products and versions are affected?: @sveltejs/kit (npm) SEMVER:introduced=2.38.0,fixed=2.60.1.
Is there a fix for CVE-2026-82258?: Yes. @sveltejs/kit (npm): upgrade to 2.60.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82258 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82258?: Check whether you run @sveltejs/kit (npm) or SvelteKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@sveltejs/kit (npm): upgrade to 2.60.1 or later
```
npm install @sveltejs/kit@2.60.1
```

Technical details

This vulnerability is a race condition (CWE-200: Information Exposure) in the query.batch() function introduced in version 2.38.0. Under very rare and specific timing conditions, concurrent requests from different users can merge and resolve under a single request context, enabling unintended cross-user data disclosure. The attack requires network-accessible conditions with high attack complexity and low privileges. The vulnerability is fixed in version 2.60.1. A patch commit has been published that prevents the batch cross-talk by properly isolating concurrent request contexts.

Affected products

SvelteJS Kit >=2.38.0, <=2.60.0

Identifiers

CVE-2026-82258
GHSA-hgv7-v322-mmgr

Timeline

2026-05-21: disclosed: Published as GHSA-hgv7-v322-mmgr
2026-05-21: patched: Fixed in version 2.60.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.