CVE-2026-82258 SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch
Attackers can exploit a race condition in SvelteKit's query.batch to access sensitive data from other users' concurrent requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-82258?
CVE-2026-82258 is a medium-severity vulnerability in sveltejs kit, published on 28 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.
Weakness: CWE-362
Which versions are affected by CVE-2026-82258?
2 open source packages ship an affected version, including @sveltejs/kit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@sveltejs/kit npm | From 2.38.0 | 2.60.1 |
@sveltejs/kit npm | From 2.38.0 | 2.60.1 |
Products include Svelte Sveltekit.
How do I fix CVE-2026-82258?
Upgrade @sveltejs/kit to 2.60.1 or later.
Is CVE-2026-82258 being exploited?
There is no known exploitation of CVE-2026-82258 in the wild and no public exploit code.
Other vulnerabilities in sveltejs kit
- CVE-2023-29008 SvelteKit framework has Insufficient CSRF protection for CORS requests
- CVE-2023-29003 SvelteKit has Insufficient Cross-Site Request Forgery Protection
- CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form
- CVE-2026-82260 SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
- CVE-2026-82261 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
Sources
Also known as GHSA-hgv7-v322-mmgr, GHSA-m99x-q38g-c4c6.