Skip to content
Sign in
5.9 Medium

CVE-2026-82258 SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests…

Description

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.

Affected products and versions

Product Affected versions Fixed in
kit 2.60 earliest → < 2.60.1 2.60.1
kit 2.38 2.38.0 → < 2.60.1 2.60.1

Other CVEs of kit

The 22 CVEs of kit →
CVE-2026-114063 SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on… 8.7 High CVE-2026-114062 SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach… 6.9 Medium CVE-2026-114061 SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a… 2.3 Low CVE-2026-114060 SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on… 2.1 Low
Track this CVE