CVE-2026-66062: CVE-2026-66062: Regular Expression Denial of Service (ReDoS) in SvelteKit Content Negotiation

#security #cve #cybersecurity

CVE-2026-66062: Regular Expression Denial of Service (ReDoS) in SvelteKit Content Negotiation

Vulnerability ID: CVE-2026-66062
CVSS Score: 5.3
Published: 2026-08-07

A Regular Expression Denial of Service (ReDoS) vulnerability exists in SvelteKit's content negotiation header parser prior to version 2.70.2. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted Accept header with highly repetitive malformed values. This triggers catastrophic backtracking on the single-threaded Node.js/Bun event loop, leading to CPU exhaustion and full denial of service.

TL;DR

SvelteKit versions before 2.70.2 are vulnerable to a CPU-exhausting ReDoS via malformed Accept headers due to an unanchored regular expression in its content negotiation parser.

Technical Details

CWE ID: CWE-1333 (Inefficient Regular Expression Complexity)
Attack Vector: Network (AV:N)
CVSS: 5.3 (Medium)
EPSS: N/A
Impact: Denial of Service (DoS)
Exploit Status: PoC Available
KEV Status: Not Listed

Affected Systems

SvelteKit Server Applications
Node.js execution environments running @sveltejs/kit
Bun execution environments running @sveltejs/kit
@sveltejs/kit: < 2.70.2 (Fixed in: 2.70.2)

Code Analysis

Commit: 82712fc

fix: prevent catastrophic backtracking in negotiate regex

Mitigation Strategies

Upgrade to @sveltejs/kit version 2.70.2 or later
Enforce strict HTTP header size limit in reverse proxies
Deploy WAF rules to reject Accept headers without forward slashes

Remediation Steps:

Open your project's package.json file
Update the @sveltejs/kit dependency to ^2.70.2
Run your package manager's installation command (e.g., npm install or pnpm install) to update lockfiles
Deploy the updated code to production environments

References

Read the full report for CVE-2026-66062 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community