{"id":"CVE-2026-66062","revision":"c0c56e6a0a9c42649a5a3476557cf26f","records":[{"revision":"c0c56e6a0a9c42649a5a3476557cf26f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-66062","aliases":[],"title":"SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header","description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.","state":0,"publishedAt":"2026-08-07T16:49:43.853+00:00","modifiedAt":"2026-08-07T21:02:12.997+00:00","affected":[{"ecosystem":"Vendor product","name":"kit","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sveltejs\",\n                    \"product\": \"kit\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.70.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68","https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5","https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-66062","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-66062","identifiers":["CVE-2026-66062"]},"retained":false,"historicalAffected":[]}],"coverage":[]}