An open index of dependabot pull requests across open source projects.

@sveltejs/kit

Ecosystem:
npm
Package URL:
pkg:npm/@sveltejs/kit
Total PRs:
8,306 Dependabot PRs
Latest PR:
about 4 hours ago
Unique Repositories:
1,930 repositories
Unique Repos (30 days):
48 repositories
Security Advisories
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass
GHSA-2crg-3p73-43xp CVE-2026-40073 HIGH published 7 months ago • updated 4 days ago
Under certain circumstances, requests could bypass the `BODY_SIZE_LIMIT` on SvelteKit applications running with `adapter-node`. This bypass does no...
CPU exhaustion in SvelteKit remote form deserialization (experimental only)
GHSA-88qp-p4qg-rqm6 MODERATE published 8 months ago • updated 18 days ago
Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the serve...
@sveltejs/kit vulnerable to XSS on dev mode 404 page
GHSA-rjjv-87mx-6x3h CVE-2024-53261 LOW published almost 2 years ago • updated 4 days ago
### Summary "Unsanitized input from *the request URL* flows into `end`, where it is used to render an HTML page returned to the user. This may res...
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
GHSA-29g2-3rmr-qm68 CVE-2026-66062 MODERATE published 3 months ago • updated 4 days ago
### Impact SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted `Accept` headers. The impact is mitigated by defau...
SvelteKit: URL redirection to untrusted site via enhanced form submission
GHSA-pfhg-q3qv-9q6r CVE-2026-114060 LOW published 6 days ago • updated 4 days ago
### Impact Applications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, such as catch-all routes, may ...
Recent PRs
Bump @sveltejs/kit from 2.70.3 to 3.0.0

itriumid/honk #53

2.70.3 → 3.0.0 Major PR
Open about 16 hours ago 1 comment
itriumid
Bump the development-dependencies group with 11 updates

mhkeller/layercake #437

3.0.0-next.25 → 3.0.0-next.30
Open 29 days ago 1 comment
mhkeller
Package Details
Name: @sveltejs/kit
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/@sveltejs/kit
JSON API: View JSON
Security Advisories

19

Active advisories
HIGH 6
MODERATE 8
LOW 5
View All npm Advisories
Package Information
Description:

SvelteKit is the fastest way to build Svelte apps

Repository: https://github.com/sveltejs/kit
Homepage: https://svelte.dev
Latest Release: 2.21.2
over 1 year ago
Dependent Repos: 17,842
Dependent Packages: 3,630
Downloads: 2,265,474
Ranking: Top 0.2122% by dependent repos Top 0.2722% by downloads Top 0.0325% by dependent pkgs
PR Status
Open 3,526 (42.5%)
Merged 1,429 (17.2%)
Closed 2,848 (34.3%)
PR Types
Major 375 (4.5%)
Minor 5,607 (67.5%)
Patch 1,813 (21.8%)