Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-07T17:17:06.340Z",
  "pubdate": "2026-08-07T17:17:06.340Z",
  "executiveSummary": "A regular expression denial of service (ReDoS) vulnerability exists in SvelteKit prior to version 2.70.2 within the content negotiation header parser.\nThe flaw allows an unauthenticated remote attacker to cause excessive CPU consumption by supplying a maliciously crafted header value, such as the Accept header.\nThe impact of this vulnerability is a degradation or complete denial of service (DoS) affecting the availability of the web application.\nAffected systems include applications built using vulnerable versions of SvelteKit.\nExploitation requires the attacker to send HTTP requests with specially manipulated header values processed by the vulnerable parser.\nNo specific privileges are required to trigger the vulnerability, as requests are processed during standard request handling.",
  "technicalDetails": "The vulnerability stems from the content negotiation header parser utilized during SvelteKit request handling.\nSpecifically, the parser employs a regular expression susceptible to quadratic backtracking when parsing specific input patterns.\nWhen an HTTP request containing a maliciously crafted header value is processed, the regular expression engine engages in excessive backtracking.\nThis catastrophic backtracking consumes excessive CPU resources, locking up the event loop or thread handling the request.\nThe affected component is the header parsing logic responsible for interpreting content negotiation headers such as Accept.\nVulnerable product versions comprise all releases of SvelteKit prior to version 2.70.2.\nAttack execution involves an attacker transmitting an HTTP request containing the crafted header across the network to the exposed SvelteKit application.\nNo authentication or elevated privileges are necessary to initiate the attack, as HTTP headers are routinely parsed for unauthenticated incoming requests.\nThe payload behavior centers on exploiting computational complexity bounds, transforming a lightweight parsing operation into a heavy CPU-bound task.\nThe post-exploitation impact is constrained to a denial of service state, where the application becomes unresponsive to legitimate user traffic due to resource exhaustion."
}