CVE-2026-66062

5.3 Moyenne

Publiée le 07/08/2026 à 19:17 · Modifiée le 23/10/2026 à 22:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.

Traduire en français

Produits concernés

sveltejs kit

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

Faiblesses (CWE)

CWE-1333

Références

https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5
https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2
https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories