# CVE-2026-82258: SvelteJS Kit query.batch cross-talk vulnerability

Source: https://junglewise.ai/threats/cve-2026-82258-sveltejs-kit-query-batch-cross-talk-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82258 · Severity: medium · CVSS 4.8 · Published 2026-08-28

Svelte Kit is a web application framework that handles request batching for performance. Under rare timing conditions, the query.batch feature could cause concurrent requests from different users to merge into a single context, allowing one user to see another user's private data. This is a cross-user data disclosure vulnerability requiring very specific timing conditions but affecting production deployments.

Technologies: [@sveltejs/kit (npm)](https://junglewise.ai/threats/technologies/sveltejs-kit), [SvelteKit](https://junglewise.ai/threats/technologies/sveltekit). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Svelte](https://junglewise.ai/threats/vendors/svelte).

## Quick answers

**Is CVE-2026-82258 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82258 being exploited in the wild.

**How severe is CVE-2026-82258?** Medium severity, with a CVSS score of 4.8, published 28 August 2026.

**Which products and versions are affected?** @sveltejs/kit (npm) SEMVER:introduced=2.38.0,fixed=2.60.1.

**Is there a fix for CVE-2026-82258?** Yes. @sveltejs/kit (npm): upgrade to 2.60.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82258 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82258?** Check whether you run @sveltejs/kit (npm) or SvelteKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @sveltejs/kit (npm): upgrade to 2.60.1 or later

  ```sh
  npm install @sveltejs/kit@2.60.1
  ```


## Technical details

This vulnerability is a race condition (CWE-200: Information Exposure) in the query.batch() function introduced in version 2.38.0. Under very rare and specific timing conditions, concurrent requests from different users can merge and resolve under a single request context, enabling unintended cross-user data disclosure. The attack requires network-accessible conditions with high attack complexity and low privileges. The vulnerability is fixed in version 2.60.1. A patch commit has been published that prevents the batch cross-talk by properly isolating concurrent request contexts.

## Affected products

- SvelteJS Kit >=2.38.0, <=2.60.0

## Identifiers

- CVE-2026-82258
- GHSA-hgv7-v322-mmgr

## Timeline

- 2026-05-21: disclosed: Published as GHSA-hgv7-v322-mmgr
- 2026-05-21: patched: Fixed in version 2.60.1

## References

- [https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr](https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr)
- [https://github.com/sveltejs/kit/commit/dadaefc2e647a0a62f49f3ee8bc7aa46f5e27056](https://github.com/sveltejs/kit/commit/dadaefc2e647a0a62f49f3ee8bc7aa46f5e27056)

## Related threats

- [SvelteKit XSS via cache-control header in prerendered pages](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-xss-via-cache-control-header-5731f4e1)
- [SvelteKit open redirect in enhanced form actions](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-open-redirect-via-enhanced-9a8dcd94)
- [SvelteKit path traversal in vite preview server on Windows](https://junglewise.ai/threats/cve-2026-114063-sveltekit-sveltejs-kit-from-2-10-0-before-3-0-0-contains-a-path)
- [SvelteKit server-side request forgery in self-fetch fallbacks](https://junglewise.ai/threats/cve-2026-114062-sveltekit-before-3-0-0-contains-a-server-side-request-forgery)
- [SvelteKit cross-site scripting in prerendered pages](https://junglewise.ai/threats/cve-2026-114061-sveltekit-sveltejs-kit-before-3-0-0-contains-a-cross-site)