CVE-2026-66062 SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
An attacker can cause denial of service in SvelteKit applications by sending a malicious Accept header that triggers quadratic backtracking in the regex parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-66062?
CVE-2026-66062 is a medium-severity denial of service vulnerability in sveltejs kit, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.
Weakness: CWE-1333
Which versions are affected by CVE-2026-66062?
2 open source packages ship an affected version, including @sveltejs/kit.
| Package | Affected | Fixed in |
|---|---|---|
@sveltejs/kit npm | All versions | 2.70.2 |
@sveltejs/kit npm | All versions | 2.70.2 |
How do I fix CVE-2026-66062?
Upgrade @sveltejs/kit to 2.70.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-66062 being exploited?
There is no known exploitation of CVE-2026-66062 in the wild and no public exploit code.
Sources
Also known as GHSA-29g2-3rmr-qm68.