Executive brief
A vulnerability in the SvelteKit web framework could allow sensitive information to be shared between different users. Under specific timing conditions, the system might accidentally merge requests from different people, potentially showing one user's private data to another. This could lead to unauthorized access to personal accounts or confidential information.
Technical details
A vulnerability exists in @sveltejs/kit within the query.batch() functionality due to improper request context isolation. Under specific race conditions and timing, concurrent requests from different users can be merged and resolved within a single request context. This leads to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), where one user may receive data intended for another. The attack requires high complexity and specific timing (Attack Requirements: Present) to exploit. The issue is fixed in version 2.60.1.
Affected products
- Svelte @sveltejs/kit >= 2.38.0, <= 2.60.0
Timeline
- 2026-05-14: disclosed: Vulnerability reported to maintainers
- 2026-05-21: advisory: GitHub Advisory published
- 2026-05-21: patched: Fix released in version 2.60.1