CVE-2026-27118: medium-severity vulnerability in sveltejs kit
Cache poisoning in @sveltejs/adapter-vercel
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users. Successful exploitation requires a victim to visit an attacker-controlled link while authenticated. Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible. This vulnerability is fixed in 6.3.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
sveltejs · kitRelated CVEs — sveltejs kit
In the same product, most dangerous first.
CVE-2024-23641HIGHSending a GET or HEAD request with a body crashes SvelteKitEPSS 0.8%CVE-2025-67647HIGHSvelteKit Denial of service and possible SSRF when using prerenderingEPSS 0.6%CVE-2026-22803HIGHSvelteKit has a memory amplification DoS in Remote Functions binary form deserializerEPSS 0.6%CVE-2023-29003HIGHSvelteKit has Insufficient Cross-Site Request Forgery ProtectionEPSS 0.6%CVE-2026-40073HIGHSvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-nodeEPSS 0.5%CVE-2026-82259HIGHSvelteKit 2.49.0 before 2.53.3 Denial of Service via formEPSS 0.5%