CVE-2026-66062

Published: Ago 07, 2026 Last Modified: Ago 08, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low

Description

AI Translation Available

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.

1333

Inefficient Regular Expression Complexity

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Cpu)
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b2…
https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5
https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@…
https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]
https://github.com/sveltejs/kit/security/advisories/GHSA-29…
https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68