---
title: "CVEs affecting the Svelte ecosystem"
url: https://daily.dev/posts/cves-affecting-the-svelte-ecosystem-zgafjyqw3
source_url: https://svelte.dev/blog/cves-affecting-the-svelte-ecosystem
type: article
source: "Svelte Blog"
published: 2026-01-15T17:25:53.063Z
updated: 2026-01-15T17:26:15.711Z
tags: ["security", "nodejs", "svelte", "sveltekit"]
reading_time: 4
upvotes: 48
comments: 1
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# CVEs affecting the Svelte ecosystem

**[Svelte Blog](https://daily.dev/sources/svelte)** · 4 min read · 48 upvotes · 1 comments

## Summary

The Svelte team has released patches for 5 security vulnerabilities across devalue, svelte, @sveltejs/kit, and @sveltejs/adapter-node. The vulnerabilities include two DoS issues in devalue.parse causing memory/CPU exhaustion, a memory amplification DoS in SvelteKit's remote functions deserializer, a DoS and potential SSRF when using prerendering, and an XSS vulnerability via the hydratable feature. Users should upgrade to devalue 5.6.2, svelte 5.46.4, @sveltejs/kit 2.49.5, and @sveltejs/adapter-node 5.5.1. Most vulnerabilities affect applications parsing user-controlled input or using specific experimental features.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://svelte.dev/blog/cves-affecting-the-svelte-ecosystem>

## Community discussion

Top comments from developers on daily.dev.

**@petecapecod** · 3 upvotes

> Woah now Svelte got hit with a CVE too!
> It's crazy out here 😂

## Similar posts on daily.dev

- [Summary of CVE-2026-23864](https://daily.dev/posts/summary-of-cve-2026-23864-igyaclea7) · Vercel · 36 upvotes · 1 comments

---

Tags: [#security](https://daily.dev/tags/security), [#nodejs](https://daily.dev/tags/nodejs), [#svelte](https://daily.dev/tags/svelte), [#sveltekit](https://daily.dev/tags/sveltekit)

[View this post on daily.dev](https://daily.dev/posts/cves-affecting-the-svelte-ecosystem-zgafjyqw3)