CyberRota Analysis
AI-GeneratedSvelteKit versions prior to 2.70.2 are vulnerable to a denial-of-service attack due to a flawed regular expression in the content negotiation header parser, which can lead to excessive CPU consumption when processing maliciously crafted header values. This vulnerability can significantly degrade application performance or result in service outages. Developers and organizations using SvelteKit for web application development should prioritize upgrading to version 2.70.2 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.