Executive brief
Svelte Kit is a web application framework that handles request batching for performance. Under rare timing conditions, the query.batch feature could cause concurrent requests from different users to merge into a single context, allowing one user to see another user's private data. This is a cross-user data disclosure vulnerability requiring very specific timing conditions but affecting production deployments.
Technical details
This vulnerability is a race condition (CWE-200: Information Exposure) in the query.batch() function introduced in version 2.38.0. Under very rare and specific timing conditions, concurrent requests from different users can merge and resolve under a single request context, enabling unintended cross-user data disclosure. The attack requires network-accessible conditions with high attack complexity and low privileges. The vulnerability is fixed in version 2.60.1. A patch commit has been published that prevents the batch cross-talk by properly isolating concurrent request contexts.
Affected products
- SvelteJS Kit >=2.38.0, <=2.60.0
Timeline
- 2026-05-21: disclosed: Published as GHSA-hgv7-v322-mmgr
- 2026-05-21: patched: Fixed in version 2.60.1