CVE-2026-66062
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
SvelteKit is a framework for rapidly developing robust web applications using Svelte. Prior to 2.70.2, the content negotiation header parser uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.
Risk Assessment
An attacker can easily cause server overload, potentially leading to application unavailability and service disruption.
Recommendation
Upgrade SvelteKit to version 2.70.2 or later. Consider limiting header lengths at the server level.
Original NVD description (English source)
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.