Open Redirect

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Open Redirect via enhanced form actions use:enhance when handling routes that accept paths beginning with //, such as catch-all routes. An attacker can craft action paths starting with //...

@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), @turnipxenon/pineapple (>=5.0.0-alpha.1, <=5.0.0-alpha.5) +1 more potentially affected by CVE-2026-82261 via @sveltejs/kit (>=2.49.0, <=2.49.5)

@sveltejs/kit NPM version =2.49.0, =0.0.137, =5.0.0-alpha.1, =1.12.2, =1.12.3 Source cves: CVE-2026-82261 Source advisory: MEND:CVE-2026-82261...

@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), @turnipxenon/pineapple (>=5.0.0-alpha.1, <=5.0.0-alpha.5) +1 more potentially affected by CVE-2026-82260 via @sveltejs/kit (>=2.49.0, <=2.49.5)

@sveltejs/kit NPM version =2.49.0, =0.0.137, =5.0.0-alpha.1, =1.12.2, =1.12.3 Source cves: CVE-2026-82260 Source advisory: MEND:CVE-2026-82260...

@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), @turnipxenon/pineapple (>=5.0.0-alpha.1, <=5.0.0-alpha.5) +1 more potentially affected by CVE-2026-82259 via @sveltejs/kit (>=2.49.0, <=2.49.5)

@sveltejs/kit NPM version =2.49.0, =0.0.137, =5.0.0-alpha.1, =1.12.2, =1.12.3 Source cves: CVE-2026-82259 Source advisory: MEND:CVE-2026-82259...

@alexaegis/svelte-config (>=0.15.0, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=1.2.0, <=2.1.0) +6 more potentially affected by CVE-2026-82258 via @sveltejs/kit (>=2.39.1, <=2.59.1)

@sveltejs/kit NPM version =2.39.1, =0.15.0, =1.2.0, =0.0.137, =0.1.0, =2.0.0, =5.0.0-alpha.1, =0.3.2, =1.7.0, =1.15.1 Source cves: CVE-2026-82258 Source advisory: MEND:CVE-2026-82258...

@alexaegis/autotool-plugin-svelte (>=0.3.0, <=0.4.2), @alexaegis/svelte-config (>=0.5.7, <=0.15.1) +206 more potentially affected by CVE-2026-82257 via @sveltejs/kit (>=1.0.0-next.81, <=2.67.0)

@sveltejs/kit NPM version =1.0.0-next.81, =0.3.0, =0.5.7, =0.0.1-alpha.1, =1.1.9, =0.7.5, =0.0.1-beta.0, =0.0.7, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.137, =1.0.0, =0.0.1, =4.6.2, =5.1.0 and more Source cves: CVE-2026-82257 Source advisory: MEND:CVE-2026-82257...

@alexaegis/autotool-plugin-svelte (>=0.3.0, <=0.4.2), @alexaegis/svelte-config (>=0.5.7, <=0.15.1) +206 more potentially affected by CVE-2026-82256 via @sveltejs/kit (>=1.0.0-next.81, <=2.67.0)

@sveltejs/kit NPM version =1.0.0-next.81, =0.3.0, =0.5.7, =0.0.1-alpha.1, =1.1.9, =0.7.5, =0.0.1-beta.0, =0.0.7, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.137, =1.0.0, =0.0.1, =4.6.2, =5.1.0 and more Source cves: CVE-2026-82256 Source advisory: MEND:CVE-2026-82256...

CVE-2026-82260: Uncontrolled Resource Consumption

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions experimental.remoteFunctions and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process an...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +20 more potentially affected by CVE-2026-66062 via @sveltejs/kit (>=2.0.0, <=2.70.1)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =0.51.14, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.1.0, =0.2.0 and more Source cves: CVE-2026-66062 Source advisory: SNYK:JS-SVELTEJSKIT-18592743...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +20 more potentially affected by CVE-2026-66062 via @sveltejs/kit (>=2.0.0, <=2.70.1)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =0.51.14, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.1.0, =0.2.0 and more Source cves: CVE-2026-66062 Source advisory: OSV:GHSA-29G2-3RMR-QM68...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +20 more potentially affected by CVE-2026-66062 via @sveltejs/kit (>=2.0.0, <=2.70.1)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =0.51.14, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.1.0, =0.2.0 and more Source cves: CVE-2026-66062 Source advisory: GHSA-29G2-3RMR-QM68...

Regular Expression Denial of Service (ReDoS)

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Accept header processing. An attacker can exhaust CPU resources by sending specially crafted Accept headers, potentially leading to...

@alexaegis/autotool-plugin-svelte (>=0.3.0, <=0.4.2), @alexaegis/svelte-config (>=0.5.7, <=0.15.1) +207 more potentially affected by CVE-2026-66062 via @sveltejs/kit (>=1.0.0-next.81, <=2.70.1)

@sveltejs/kit NPM version =1.0.0-next.81, =0.3.0, =0.5.7, =0.0.1-alpha.1, =1.1.9, =0.7.5, =0.0.1-beta.0, =0.0.7, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.137, =1.0.0, =0.0.1, =4.6.2, =5.1.0 and more Source cves: CVE-2026-66062 Source advisory: MEND:CVE-2026-66062...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +19 more potentially affected by CVE-2026-82257 via @sveltejs/kit (>=2.0.0, <=2.67.0)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.1.0, =1.0.1-next.0, =1.0.10-next.0 and more Source cves: CVE-2026-82257 Source advisory: OSV:GHSA-866W-XMHQ-WJ7X...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +19 more potentially affected by unknown CVE via @sveltejs/kit (>=2.0.0, <=2.67.0)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.1.0, =1.0.1-next.0, =1.0.10-next.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-SVELTEJSKIT-18319512...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +19 more potentially affected by unknown CVE via @sveltejs/kit (>=2.0.0, <=2.67.0)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.1.0, =1.0.1-next.0, =1.0.10-next.0 and more Source cves: unknown CVE Source advisory: GHSA-866W-XMHQ-WJ7X...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +19 more potentially affected by unknown CVE via @sveltejs/kit (>=2.0.0, <=2.67.0)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.1.0, =1.0.1-next.0, =1.0.10-next.0 and more Source cves: unknown CVE Source advisory: GHSA-WQJV-9729-C5Q2...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +19 more potentially affected by unknown CVE via @sveltejs/kit (>=2.0.0, <=2.67.0)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.1.0, =1.0.1-next.0, =1.0.10-next.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-SVELTEJSKIT-18319510...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +19 more potentially affected by CVE-2026-82256 via @sveltejs/kit (>=2.0.0, <=2.67.0)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.1.0, =1.0.1-next.0, =1.0.10-next.0 and more Source cves: CVE-2026-82256 Source advisory: OSV:GHSA-WQJV-9729-C5Q2...

@alexaegis/svelte-config (>=0.15.0, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=1.2.0, <=2.1.0) +6 more potentially affected by unknown CVE via @sveltejs/kit (>=2.39.1, <=2.59.1)

@sveltejs/kit NPM version =2.39.1, =0.15.0, =1.2.0, =0.0.137, =0.1.0, =2.0.0, =5.0.0-alpha.1, =0.3.2, =1.7.0, =1.15.1 Source cves: unknown CVE Source advisory: GHSA-HGV7-V322-MMGR...