GHSA-29g2-3rmr-qm68
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @sveltejs/kit | < 2.70.2 | 2.70.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted `Accept` headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible.
### Patches
The vulnerability is patched in `@sveltejs/kit` version 2.70.2.
References
External links from the advisory. They lead to third-party sites.