CVE-2025-67647
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sveltejs | sveltekit | From 2.19.0 (inc) to 2.49.4 (inc) |
| sveltejs | sveltekit | 2.49.5 |
| sveltejs | adapter-node | From 5.4.1 (inc) to 5.5.0 (inc) |
| sveltejs | adapter-node | 5.5.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-248 | An exception is thrown from a function, but it is not caught. |
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-67647 is a vulnerability in SvelteKit versions from 2.19.0 to 2.49.4 and the npm package @sveltejs/adapter-node versions 5.4.1 to 5.5.0. It involves server-side request forgery (SSRF) and denial of service (DoS) risks related to the prerendering feature (routes with `export const prerender = true`). Specifically, from version 2.44.0 onward, having at least one prerendered route can cause a DoS by terminating the server process unexpectedly. From 2.19.0 onward, if the app uses adapter-node without a configured ORIGIN environment variable and lacks a reverse proxy that validates the Host header, it is vulnerable to both DoS and SSRF. SSRF allows attackers to access internal services without authentication. Additionally, attackers can perform stored cross-site scripting (SXSS) attacks via cache poisoning by forcing a CDN to cache malicious XSS content. The root cause is insufficient validation and restriction of requests during prerendering, allowing crafted requests to exploit the server. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by causing denial of service (DoS), where the server process terminates unexpectedly, disrupting your web application availability. It also allows server-side request forgery (SSRF), enabling attackers to access internal services that are otherwise unreachable without authentication, potentially exposing sensitive internal resources. Furthermore, attackers can exploit the vulnerability to perform stored cross-site scripting (SXSS) attacks via cache poisoning, which can lead to malicious scripts being served to users through cached content, compromising user security and trust. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves checking if your SvelteKit application is running a vulnerable version (2.19.0 through 2.49.4) and if it has prerendered routes (export const prerender = true). Additionally, verify if you are using adapter-node versions 5.4.1 to 5.5.0 without a configured ORIGIN environment variable and lacking a reverse proxy with Host header validation. You can detect potential exploitation by monitoring for unexpected server process terminations (DoS) or unusual internal requests indicating SSRF. Commands to check versions and environment variables might include: `npm list @sveltejs/kit` and `npm list @sveltejs/adapter-node` to check installed versions; `printenv ORIGIN` or `echo $ORIGIN` to check environment variable configuration; and inspecting server logs for crashes or unusual requests. Network monitoring tools can be used to detect SSRF attempts by analyzing outgoing requests from the server to internal services. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading SvelteKit to version 2.49.5 or later and @sveltejs/adapter-node to version 5.5.1 or later, which contain the security fixes. If upgrading is not immediately possible, ensure that the ORIGIN environment variable is properly configured when using adapter-node, and deploy a reverse proxy that validates the Host header to prevent SSRF and DoS exploitation. Additionally, review your prerendered routes and consider disabling prerendering temporarily if feasible. Implement monitoring to detect abnormal server behavior and apply the security hardening and validation improvements described in the patch, such as header normalization and validation. [1, 2]