Skip to content
OpenAdvisories
Medium · 5.9 CVE-2026-128119 EUVD-2026-125731

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applicat…

Published Nov 13, 2026 · Assigned by GitHub_M

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applications using the experimental remote functions flag could assign the same generated identifier to separate non-exported query.batch functions. When those private functions shared a request batch, arguments intended for one function could be passed to another function, causing unexpected cross-function processing and possible disclosure of function arguments. This issue is fixed in 3.1.1.

Affected products

VendorProductAffectedFixed
sveltejs kit 2.60.1, < 3.1.1 —

References