{"id":"GHSA-29g2-3rmr-qm68","revision":"90bca33a743a45188bd9d625e4c86b37","records":[{"revision":"90bca33a743a45188bd9d625e4c86b37","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-29g2-3rmr-qm68","aliases":["CVE-2026-66062"],"title":"SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header","description":"### Impact\nSvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted `Accept` headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible.\n\n### Patches\nThe vulnerability is patched in `@sveltejs/kit` version 2.70.2.","state":0,"publishedAt":"2026-08-07T16:50:02+00:00","modifiedAt":"2026-08-07T17:10:58.809703+00:00","affected":[{"ecosystem":"npm","name":"@sveltejs/kit","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.70.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68","https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5","https://github.com/sveltejs/kit","https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2"],"sourceUrl":"https://github.com/advisories/GHSA-29g2-3rmr-qm68","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-29g2-3rmr-qm68","identifiers":["GHSA-29g2-3rmr-qm68","CVE-2026-66062"]},"retained":false,"historicalAffected":[]}],"coverage":[]}