Svelte is a lightweight web-application framework and ecosystem spanning a compiler, component library, and server-side tooling (SvelteKit, adapters, and utility packages) that has gained prominence in frontend development. The vulnerability footprint reflects the framework's exposure across web-application construction and deployment: recurring weakness classes center on cross-site scripting, request-forgery, and resource-exhaustion conditions typical of application frameworks sitting between user input and server logic. The disclosures span the core compiler and related build-chain and adapter products, capturing vulnerabilities that can propagate across projects built on the framework. Defenders using this toolchain should track releases alongside their dependency-update cycles and apply updates to framework and adapter versions; live severity and exploitation details are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Svelte over time
Signals from CVEs in this vendor scope (26 CVEs).
26 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-22775HIGH Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.p | Jan 15, 2026 | 7.5 | 31 | NO | NO |
CVE-2026-42570HIGH Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.par | Jun 9, 2026 | 7.5 | 30 | NO | NO |
CVE-2026-40074HIGH SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a l | Apr 10, 2026 | 7.5 | 30 | NO | NO |
CVE-2026-42567HIGH Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:e | Jun 9, 2026 | 7.5 | 28 | NO | NO |
CVE-2026-22803HIGH SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data fo | Jan 15, 2026 | 7.5 | 28 | NO | NO |
CVE-2026-22774HIGH Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.p | Jan 15, 2026 | 7.5 | 28 | NO | NO |
CVE-2025-67647CRITICAL SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) a | Jan 15, 2026 | 9.1 | 28 | NO | NO |
CVE-2023-29008HIGH The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP method | Apr 6, 2023 | 8.8 | 27 | NO | NO |
CVE-2026-42599MEDIUM Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties are included in | Jun 9, 2026 | 6.1 | 25 | NO | NO |
CVE-2026-42573MEDIUM Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to | Jun 9, 2026 | 6.1 | 25 | NO | NO |
Signals from CVEs in this vendor scope (26 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Svelte.
Media articles that mention a CVE ID that affects a product developed by Svelte — matched by CVE ID, not by vendor name.