{"id":"EUVD-2026-54557","revision":"6d98a9fa940e426baaaca0b14121ebee","records":[{"revision":"6d98a9fa940e426baaaca0b14121ebee","observedAt":"2026-11-01T11:30:54.145+00:00","statement":{"source":"euvd","id":"EUVD-2026-54557","aliases":["CVE-2026-66062","GHSA-29g2-3rmr-qm68"],"title":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expres…","description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68","https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5","https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54557","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 7, 2026, 4:49:43 PM","dateUpdated":"Aug 7, 2026, 9:02:12 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-54557","identifiers":["EUVD-2026-54557","CVE-2026-66062","GHSA-29g2-3rmr-qm68"]},"retained":false,"historicalAffected":[]}],"coverage":[]}