CVE-2026-66062

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5
https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2
https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) SvelteKit es un framework para desarrollar rápidamente aplicaciones web robustas y de alto rendimiento usando Svelte. Antes de la versión 2.70.2, el analizador de encabezados de negociación de contenido utilizado por el manejo de solicitudes de SvelteKit (para encabezados como Accept) utiliza una expresión regular vulnerable a retroceso cuadrático, por lo que un valor de encabezado creado maliciosamente puede causar un consumo excesivo de CPU y degradar o denegar el servicio. La versión 2.70.2 soluciona el problema.

Information

Published : 2026-08-07 17:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-66062

Mitre link : CVE-2026-66062

CVE.ORG link : CVE-2026-66062

JSON object : View

Products Affected

No product.

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2026-66062", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66062", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T20:58:04.458547Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sveltejs", "product": "kit", "versions": [{"status": "affected", "version": "< 2.70.2"}]}]}], "published": "2026-08-07T17:17:06.340", "references": [{"url": "https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5", "source": "security-advisories@github.com"}, {"url": "https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue."}, {"lang": "es", "value": "SvelteKit es un framework para desarrollar r\u00e1pidamente aplicaciones web robustas y de alto rendimiento usando Svelte. Antes de la versi\u00f3n 2.70.2, el analizador de encabezados de negociaci\u00f3n de contenido utilizado por el manejo de solicitudes de SvelteKit (para encabezados como Accept) utiliza una expresi\u00f3n regular vulnerable a retroceso cuadr\u00e1tico, por lo que un valor de encabezado creado maliciosamente puede causar un consumo excesivo de CPU y degradar o denegar el servicio. La versi\u00f3n 2.70.2 soluciona el problema."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "security-advisories@github.com"}