Vendor
sveltejs
48 known vulnerabilities.
Products
21 results · Clear filters · Feed
-
High 7.5
Devalue before 5.6.3 Denial of Service via Sparse Array Serialization
The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and seriali…
-
High 7.5
Devalue before 5.9.3 CPU Amplification Denial of Service via uneval
Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to t…
-
High 7.5
Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval
Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a ve…
-
High 7.5
Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays
Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array ser…
-
High 7.5
Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse
Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to …
-
High 7.5
Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection
devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller cat…
-
High 7.5
SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview …
-
High 7.5
devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rat…
-
High 7.5
SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive wh…
-
High 7.5
SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memor…
-
High 7.5
SvelteKit 2.49.0 before 2.53.3 Denial of Service via form
SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array …
-
High 7.5
Svelte devalue: DoS via sparse array deserialization
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate mu…
-
High 8.2
SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not…
-
High 7.5
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial…
-
High 7.5
devalue vulnerable to denial of service due to memory exhaustion in devalue.parse
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial…
-
High 8.2
SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted pa…
-
High 8.4
SvelteKit Denial of service and possible SSRF when using prerendering
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4…
-
High 7.9
Svelte devalue vulnerable to prototype pollution
Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects a…
-
High 7.5
Sending a GET or HEAD request with a body crashes SvelteKit
SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must m…
-
High 8.8
SvelteKit framework has Insufficient CSRF protection for CORS requests
The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protecti…
-
High 8.8
SvelteKit has Insufficient Cross-Site Request Forgery Protection
SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box …