@affinity-lab/sk-messaging (>=1.0.4, <=1.0.5), @affinity-lab/sk-mik-id-sso-client (>=1.0.0, <=1.0.1) +25 more potentially affected by CVE-2026-114060 via @sveltejs/kit (3.0.0-next.32)

@sveltejs/kit NPM version 3.0.0-next.32 is affected by a known vulnerability. The following packages have a transitive dependency on @sveltejs/kit and may be impacted: - @affinity-lab/sk-messaging =1.0.4, =1.0.0, =1.0.0, =1.0.0, =2.2.3-beta.1, =1.1.0, =1.0.3, =1.0.0, =0.0.2, =0.0.1-alpha.1, =0.0....

@affinity-lab/sk-messaging (>=1.0.4, <=1.0.5), @affinity-lab/sk-mik-id-sso-client (>=1.0.0, <=1.0.1) +25 more potentially affected by CVE-2026-114060 via @sveltejs/kit (3.0.0-next.32)

@sveltejs/kit NPM version 3.0.0-next.32 is affected by a known vulnerability. The following packages have a transitive dependency on @sveltejs/kit and may be impacted: - @affinity-lab/sk-messaging =1.0.4, =1.0.0, =1.0.0, =1.0.0, =2.2.3-beta.1, =1.1.0, =1.0.3, =1.0.0, =0.0.2, =0.0.1-alpha.1, =0.0....

@affinity-lab/sk-messaging (>=1.0.4, <=1.0.5), @affinity-lab/sk-mik-id-sso-client (>=1.0.0, <=1.0.1) +25 more potentially affected by CVE-2026-114061 via @sveltejs/kit (3.0.0-next.32)

@sveltejs/kit NPM version 3.0.0-next.32 is affected by a known vulnerability. The following packages have a transitive dependency on @sveltejs/kit and may be impacted: - @affinity-lab/sk-messaging =1.0.4, =1.0.0, =1.0.0, =1.0.0, =2.2.3-beta.1, =1.1.0, =1.0.3, =1.0.0, =0.0.2, =0.0.1-alpha.1, =0.0....

@2077collective/persona (>=0.0.1, <=0.0.3), @acudac/md3-svelte (>=1.1.2, <=1.1.19) +258 more potentially affected by CVE-2026-114063 via @sveltejs/kit (>=2.16.1, <=3.0.0-next.32)

@sveltejs/kit NPM version =2.16.1, =0.0.1, =1.1.2, =1.0.1, =1.0.4, =1.0.0, =1.0.0, =1.0.0, =1.0.183, =0.0.1, =0.14.0, =0.1.0-beta.1, =0.3.37, =0.2.30, =0.6.1, =0.0.7, =1.0.0 and more Source cves: CVE-2026-114063 Source advisory: SNYK:JS-SVELTEJSKIT-21347778...

Directory Traversal

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Directory Traversal via the vite preview server on Windows, where requests with path traversal sequences can escape the prerendered output directory and read arbitrary files accessible to t...

@affinity-lab/sk-messaging (>=1.0.4, <=1.0.5), @affinity-lab/sk-mik-id-sso-client (>=1.0.0, <=1.0.1) +25 more potentially affected by CVE-2026-114060 via @sveltejs/kit (3.0.0-next.32)

@sveltejs/kit NPM version 3.0.0-next.32 is affected by a known vulnerability. The following packages have a transitive dependency on @sveltejs/kit and may be impacted: - @affinity-lab/sk-messaging =1.0.4, =1.0.0, =1.0.0, =1.0.0, =2.2.3-beta.1, =1.1.0, =1.0.3, =1.0.0, =0.0.2, =0.0.1-alpha.1, =0.0....

Open Redirect

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Open Redirect via enhanced form actions use:enhance when handling routes that accept paths beginning with //, such as catch-all routes. An attacker can craft action paths starting with //...

@affinity-lab/sk-messaging (>=1.0.4, <=1.0.5), @affinity-lab/sk-mik-id-sso-client (>=1.0.0, <=1.0.1) +25 more potentially affected by CVE-2026-114062 via @sveltejs/kit (3.0.0-next.32)

@sveltejs/kit NPM version 3.0.0-next.32 is affected by a known vulnerability. The following packages have a transitive dependency on @sveltejs/kit and may be impacted: - @affinity-lab/sk-messaging =1.0.4, =1.0.0, =1.0.0, =1.0.0, =2.2.3-beta.1, =1.1.0, =1.0.3, =1.0.0, =0.0.2, =0.0.1-alpha.1, =0.0....

Server-side Request Forgery (SSRF)

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via server-side self-fetch fallbacks that automatically follow HTTP redirects. SvelteKit makes server-side fallback requests to URLs derived from the incomi...

@affinity-lab/sk-messaging (>=1.0.4, <=1.0.5), @affinity-lab/sk-mik-id-sso-client (>=1.0.0, <=1.0.1) +25 more potentially affected by CVE-2026-114063 via @sveltejs/kit (3.0.0-next.32)

@sveltejs/kit NPM version 3.0.0-next.32 is affected by a known vulnerability. The following packages have a transitive dependency on @sveltejs/kit and may be impacted: - @affinity-lab/sk-messaging =1.0.4, =1.0.0, =1.0.0, =1.0.0, =2.2.3-beta.1, =1.1.0, =1.0.3, =1.0.0, =0.0.2, =0.0.1-alpha.1, =0.0....

@affinity-lab/sk-messaging (>=1.0.4, <=1.0.5), @affinity-lab/sk-mik-id-sso-client (>=1.0.0, <=1.0.1) +25 more potentially affected by CVE-2026-114062 via @sveltejs/kit (3.0.0-next.32)

@sveltejs/kit NPM version 3.0.0-next.32 is affected by a known vulnerability. The following packages have a transitive dependency on @sveltejs/kit and may be impacted: - @affinity-lab/sk-messaging =1.0.4, =1.0.0, =1.0.0, =1.0.0, =2.2.3-beta.1, =1.1.0, =1.0.3, =1.0.0, =0.0.2, =0.0.1-alpha.1, =0.0....

@affinity-lab/sk-messaging (>=1.0.4, <=1.0.5), @affinity-lab/sk-mik-id-sso-client (>=1.0.0, <=1.0.1) +25 more potentially affected by CVE-2026-114061 via @sveltejs/kit (3.0.0-next.32)

@sveltejs/kit NPM version 3.0.0-next.32 is affected by a known vulnerability. The following packages have a transitive dependency on @sveltejs/kit and may be impacted: - @affinity-lab/sk-messaging =1.0.4, =1.0.0, =1.0.0, =1.0.0, =2.2.3-beta.1, =1.1.0, =1.0.3, =1.0.0, =0.0.2, =0.0.1-alpha.1, =0.0....

@affinity-lab/sk-messaging (>=1.0.4, <=1.0.5), @affinity-lab/sk-mik-id-sso-client (>=1.0.0, <=1.0.1) +25 more potentially affected by CVE-2026-114060 via @sveltejs/kit (3.0.0-next.32)

@sveltejs/kit NPM version 3.0.0-next.32 is affected by a known vulnerability. The following packages have a transitive dependency on @sveltejs/kit and may be impacted: - @affinity-lab/sk-messaging =1.0.4, =1.0.0, =1.0.0, =1.0.0, =2.2.3-beta.1, =1.1.0, =1.0.3, =1.0.0, =0.0.2, =0.0.1-alpha.1, =0.0....

@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), @turnipxenon/pineapple (>=5.0.0-alpha.1, <=5.0.0-alpha.5) +1 more potentially affected by CVE-2026-82261 via @sveltejs/kit (>=2.49.0, <=2.49.5)

@sveltejs/kit NPM version =2.49.0, =0.0.137, =5.0.0-alpha.1, =1.12.2, =1.12.3 Source cves: CVE-2026-82261 Source advisory: MEND:CVE-2026-82261...

@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), @turnipxenon/pineapple (>=5.0.0-alpha.1, <=5.0.0-alpha.5) +1 more potentially affected by CVE-2026-82260 via @sveltejs/kit (>=2.49.0, <=2.49.5)

@sveltejs/kit NPM version =2.49.0, =0.0.137, =5.0.0-alpha.1, =1.12.2, =1.12.3 Source cves: CVE-2026-82260 Source advisory: MEND:CVE-2026-82260...

@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), @turnipxenon/pineapple (>=5.0.0-alpha.1, <=5.0.0-alpha.5) +1 more potentially affected by CVE-2026-82259 via @sveltejs/kit (>=2.49.0, <=2.49.5)

@sveltejs/kit NPM version =2.49.0, =0.0.137, =5.0.0-alpha.1, =1.12.2, =1.12.3 Source cves: CVE-2026-82259 Source advisory: MEND:CVE-2026-82259...

@alexaegis/svelte-config (>=0.15.0, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=1.2.0, <=2.1.0) +6 more potentially affected by CVE-2026-82258 via @sveltejs/kit (>=2.39.1, <=2.59.1)

@sveltejs/kit NPM version =2.39.1, =0.15.0, =1.2.0, =0.0.137, =0.1.0, =2.0.0, =5.0.0-alpha.1, =0.3.2, =1.7.0, =1.15.1 Source cves: CVE-2026-82258 Source advisory: MEND:CVE-2026-82258...

@alexaegis/autotool-plugin-svelte (>=0.3.0, <=0.4.2), @alexaegis/svelte-config (>=0.5.7, <=0.15.1) +206 more potentially affected by CVE-2026-82257 via @sveltejs/kit (>=1.0.0-next.81, <=2.67.0)

@sveltejs/kit NPM version =1.0.0-next.81, =0.3.0, =0.5.7, =0.0.1-alpha.1, =1.1.9, =0.7.5, =0.0.1-beta.0, =0.0.7, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.137, =1.0.0, =0.0.1, =4.6.2, =5.1.0 and more Source cves: CVE-2026-82257 Source advisory: MEND:CVE-2026-82257...

@alexaegis/autotool-plugin-svelte (>=0.3.0, <=0.4.2), @alexaegis/svelte-config (>=0.5.7, <=0.15.1) +206 more potentially affected by CVE-2026-82256 via @sveltejs/kit (>=1.0.0-next.81, <=2.67.0)

@sveltejs/kit NPM version =1.0.0-next.81, =0.3.0, =0.5.7, =0.0.1-alpha.1, =1.1.9, =0.7.5, =0.0.1-beta.0, =0.0.7, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.137, =1.0.0, =0.0.1, =4.6.2, =5.1.0 and more Source cves: CVE-2026-82256 Source advisory: MEND:CVE-2026-82256...

CVE-2026-82260: Uncontrolled Resource Consumption

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions experimental.remoteFunctions and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process an...