Description
SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sveltejs | kit | 2.38.0 – < 2.60.1 | 2.60.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @sveltejs/kit | >= 2.38.0, < 2.60.1 | 2.60.1 | GHSA-hgv7-v322-mmgr |
References
- GitHub Security Advisory (GHSA-hgv7-v322-mmgr) vendor-advisory
- VulnCheck Advisory: SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch third-party-advisory