{"id":"EUVD-2026-54557","enisaUuid":"2223d7c9-6e18-32d3-85da-bea1e48f7033","description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit\u0027s request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.","datePublished":"Aug 7, 2026, 4:49:43 PM","dateUpdated":"Aug 7, 2026, 9:02:12 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68\nhttps://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5\nhttps://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2\n","aliases":"CVE-2026-66062\nGHSA-29g2-3rmr-qm68\n","assigner":"GitHub_M","epss":0.51,"enisaIdProduct":[{"id":"a4db3d82-285e-3f14-8061-706eb25bae08","product":{"name":"kit","vendor":{"name":"sveltejs"}},"product_version":"\u003c 2.70.2"}],"enisaIdVendor":[{"id":"4e3a9411-5394-300d-a7fe-85e97f79f5c5","vendor":{"name":"sveltejs"}}],"enisaIdVulnerability":[{"id":"7db971dc-6d0d-3fc8-8ea1-02f339da462e","vulnerability":{"id":"CVE-2026-66062","description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit\u0027s request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.","datePublished":"Aug 7, 2026, 4:49:43 PM","dateUpdated":"Aug 7, 2026, 9:02:12 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68\nhttps://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5\nhttps://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2\n","enisa_id":"EUVD-2026-54557\n","assigner":"GitHub_M","epss":0.51,"dataProcessed":"Nov 7, 2026, 7:19:55 AM","vulnerabilityProduct":[{"id":"e085ae7a-179c-38b5-b585-03f46a3691e2","product":{"name":"kit","vendor":{"name":"sveltejs"}},"product_version":"\u003c 2.70.2"}],"vulnerabilityVendor":[{"id":"9709ddca-9131-3eb1-adba-d100f0cf796f","vendor":{"name":"sveltejs"}}]}},{"id":"a9c1711e-a236-3493-8b5e-d3aca0347762","vulnerability":{"id":"GHSA-29g2-3rmr-qm68","description":"SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header","datePublished":"Aug 7, 2026, 4:50:02 PM","dateUpdated":"Aug 7, 2026, 4:50:02 PM","baseScore":0.0,"references":"https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68\nhttps://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5\nhttps://github.com/sveltejs/kit\nhttps://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2\n","enisa_id":"EUVD-2026-54557\n","aliases":"GHSA-29g2-3rmr-qm68\nCVE-2026-66062\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}