CVE-2026-66062
Received Received - Intake

Denial of Service in SvelteKit via Header Parsing

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-66062
EUVD
EUVD-2026-54557

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sveltejs sveltekit to 2.70.2 (exc)
sveltejs sveltekit 2.70.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a regular expression denial of service (ReDoS) issue in SvelteKit versions before 2.70.2. It occurs when parsing Accept headers using a regex vulnerable to quadratic backtracking. Maliciously crafted header values cause excessive CPU usage, leading to degraded performance or service denial.

Detection Guidance

Monitor for unusually high CPU usage on servers running SvelteKit versions prior to 2.70.2 when processing Accept headers. Check for malformed or excessively long header values in web server logs. Use tools like Wireshark to inspect incoming HTTP requests for suspicious Accept header patterns.

Impact Analysis

An attacker could send specially formatted Accept headers to consume excessive CPU resources on your server. This may slow down or crash your application, making it unavailable to legitimate users. Systems with higher header length limits are more vulnerable.

Compliance Impact

This vulnerability primarily impacts system availability by causing excessive CPU consumption through crafted Accept headers, which could lead to service degradation or denial of service. While it does not directly affect data confidentiality or integrity, prolonged unavailability could potentially impact compliance with standards like GDPR (data processing timelines) or HIPAA (service availability requirements) if critical systems are affected.

Mitigation Strategies

Upgrade SvelteKit to version 2.70.2 or later immediately. Implement network-level header length limits to block excessively long Accept headers. Review and update web server configurations to enforce default header size restrictions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66062. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart