CVE-2026-66062

{
  "id": "CVE-2026-66062",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T17:17:06.340",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue."
    },
    {
      "lang": "es",
      "value": "SvelteKit es un framework para desarrollar rápidamente aplicaciones web robustas y de alto rendimiento usando Svelte. Antes de la versión 2.70.2, el analizador de encabezados de negociación de contenido utilizado por el manejo de solicitudes de SvelteKit (para encabezados como Accept) utiliza una expresión regular vulnerable a retroceso cuadrático, por lo que un valor de encabezado creado maliciosamente puede causar un consumo excesivo de CPU y degradar o denegar el servicio. La versión 2.70.2 soluciona el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "sveltejs",
          "product": "kit",
          "versions": [
            {
              "version": "< 2.70.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T20:58:04.458547Z",
          "id": "CVE-2026-66062",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68",
      "source": "[email protected]"
    }
  ]
}