Vulnerability GHSA-rqw3-x7hx-mm3p
Medium Risk
MEDIUM RISK
CVSS Score: 5.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 hours ago
November 13, 2026 at 08:36 PM UTC
SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`
>=5.5.7 <5.5.8, >=6.0.0-next.0 <6.0.1
>=5.5.7 <5.5.8, >=6.0.0-next.0 <6.0.1
Summary
SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`
Details
In affected versions, @sveltejs/adapter-node can attempt to add a header to an immutable request in a context that causes the server to crash, denying service to any other requests routed to that server.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
10 months ago
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
>=5.4.1 <5.5.1 GHSA-j62c-4x62-9r35
>=5.4.1 <5.5.1 GHSA-j62c-4x62-9r35
High Risk
2 years ago
Sending a GET or HEAD request with a body crashes SvelteKit
4.0.0 GHSA-g5m6-hxpp-fc49
4.0.0 GHSA-g5m6-hxpp-fc49
Impacted packages
Timeline
Published
4 hours ago
November 13, 2026 at 08:36 PM UTC
Fixed (6.0.1)
15 days ago
October 29, 2026 at 11:47 PM UTC
Fixed (5.5.8)
8 days ago
November 05, 2026 at 12:29 PM UTC
Last Modified
4 hours ago
November 13, 2026 at 08:45 PM UTC