CVE-2025-67647

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-67647

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67647.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-67647

Aliases

GHSA-j62c-4x62-9r35

Published

2026-01-15T18:33:25Z

Modified

2026-10-21T02:30:40Z

Severity

8.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:N CVSS Calculator

Summary

SvelteKit Denial of service and possible SSRF when using prerendering

Details

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. This vulnerability is fixed in 2.49.5.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-248",
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67647.json"
}

References

Affected packages

Git / github.com/sveltejs/kit

Affected ranges

Type

GIT

Repo

https://github.com/sveltejs/kit

Events

Introduced

43544107269013e8b5160d268da25f1e003b6f6f

Fixed

c89805e4a4af14859d44f625bd83344e3d1a08b0

Introduced

d6f9beb825034ba239eed2d5e76fcb728fb8369f

Fixed

80ffb53382e397a8fc83e6b63d2675eeabb427bd

Fixed

d9ae9b00b14f5574d109f3fd548f960594346226

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:svelte:adapter-node:*:*:*:*:*:node.js:*:*",
            "range":  [
                {
                    "introduced":  "5.4.1"
                },
                {
                    "fixed":  "5.5.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:svelte:kit:*:*:*:*:*:node.js:*:*",
            "range":  [
                {
                    "introduced":  "2.19.0"
                },
                {
                    "fixed":  "2.49.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "d9ae9b00b14f5574d109f3fd548f960594346226"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

@sveltejs/adapter-auto@3.*

@sveltejs/adapter-auto@3.2.3

@sveltejs/adapter-auto@3.2.4

@sveltejs/adapter-auto@3.2.5

@sveltejs/adapter-auto@3.3.1

@sveltejs/adapter-auto@5.*

@sveltejs/adapter-auto@5.0.0

@sveltejs/adapter-auto@6.*

@sveltejs/adapter-auto@6.0.0

@sveltejs/adapter-auto@6.0.1

@sveltejs/adapter-auto@6.0.2

@sveltejs/adapter-auto@6.1.0

@sveltejs/adapter-auto@6.1.1

@sveltejs/adapter-auto@7.*

@sveltejs/adapter-auto@7.0.0

@sveltejs/adapter-cloudflare-workers@2.*

@sveltejs/adapter-cloudflare-workers@2.5.1

@sveltejs/adapter-cloudflare-workers@2.5.2

@sveltejs/adapter-cloudflare-workers@2.5.3

@sveltejs/adapter-cloudflare-workers@2.5.4

@sveltejs/adapter-cloudflare-workers@2.5.5

@sveltejs/adapter-cloudflare-workers@2.5.6

@sveltejs/adapter-cloudflare-workers@2.6.0

@sveltejs/adapter-cloudflare-workers@2.9.0

@sveltejs/adapter-cloudflare@4.*

@sveltejs/adapter-cloudflare@4.6.1

@sveltejs/adapter-cloudflare@4.7.0

@sveltejs/adapter-cloudflare@4.7.1

@sveltejs/adapter-cloudflare@4.7.2

@sveltejs/adapter-cloudflare@4.7.3

@sveltejs/adapter-cloudflare@4.7.4

@sveltejs/adapter-cloudflare@4.8.0

@sveltejs/adapter-cloudflare@5.*

@sveltejs/adapter-cloudflare@5.1.0

@sveltejs/adapter-cloudflare@6.*

@sveltejs/adapter-cloudflare@6.0.0

@sveltejs/adapter-cloudflare@6.0.1

@sveltejs/adapter-cloudflare@7.*

@sveltejs/adapter-cloudflare@7.0.0

@sveltejs/adapter-cloudflare@7.0.1

@sveltejs/adapter-cloudflare@7.0.2

@sveltejs/adapter-cloudflare@7.0.3

@sveltejs/adapter-cloudflare@7.0.4

@sveltejs/adapter-cloudflare@7.0.5

@sveltejs/adapter-cloudflare@7.1.0

@sveltejs/adapter-cloudflare@7.1.1

@sveltejs/adapter-cloudflare@7.1.2

@sveltejs/adapter-cloudflare@7.1.3

@sveltejs/adapter-cloudflare@7.2.0

@sveltejs/adapter-cloudflare@7.2.1

@sveltejs/adapter-cloudflare@7.2.2

@sveltejs/adapter-cloudflare@7.2.3

@sveltejs/adapter-cloudflare@7.2.4

@sveltejs/adapter-netlify@4.*

@sveltejs/adapter-netlify@4.3.1

@sveltejs/adapter-netlify@4.3.2

@sveltejs/adapter-netlify@4.3.3

@sveltejs/adapter-netlify@4.3.4

@sveltejs/adapter-netlify@4.3.5

@sveltejs/adapter-netlify@4.3.6

@sveltejs/adapter-netlify@4.4.0

@sveltejs/adapter-netlify@5.*

@sveltejs/adapter-netlify@5.0.0

@sveltejs/adapter-netlify@5.0.1

@sveltejs/adapter-netlify@5.0.2

@sveltejs/adapter-netlify@5.1.0

@sveltejs/adapter-netlify@5.1.1

@sveltejs/adapter-netlify@5.2.0

@sveltejs/adapter-netlify@5.2.1

@sveltejs/adapter-netlify@5.2.2

@sveltejs/adapter-netlify@5.2.3

@sveltejs/adapter-netlify@5.2.4

@sveltejs/adapter-node@5.*

@sveltejs/adapter-node@5.2.1

@sveltejs/adapter-node@5.2.13

@sveltejs/adapter-node@5.2.14

@sveltejs/adapter-node@5.2.15

@sveltejs/adapter-node@5.2.16

@sveltejs/adapter-node@5.2.2

@sveltejs/adapter-node@5.2.3

@sveltejs/adapter-node@5.2.4

@sveltejs/adapter-node@5.2.5

@sveltejs/adapter-node@5.2.6

@sveltejs/adapter-node@5.2.7

@sveltejs/adapter-node@5.2.8

@sveltejs/adapter-node@5.2.9

@sveltejs/adapter-node@5.3.0

@sveltejs/adapter-node@5.3.1

@sveltejs/adapter-node@5.3.2

@sveltejs/adapter-node@5.3.3

@sveltejs/adapter-node@5.4.0

@sveltejs/adapter-node@5.5.0

@sveltejs/adapter-static@3.*

@sveltejs/adapter-static@3.0.10

@sveltejs/adapter-static@3.0.3

@sveltejs/adapter-static@3.0.4

@sveltejs/adapter-static@3.0.5

@sveltejs/adapter-static@3.0.6

@sveltejs/adapter-static@3.0.9

@sveltejs/adapter-vercel@5.*

@sveltejs/adapter-vercel@5.10.0

@sveltejs/adapter-vercel@5.10.1

@sveltejs/adapter-vercel@5.10.2

@sveltejs/adapter-vercel@5.10.3

@sveltejs/adapter-vercel@5.4.1

@sveltejs/adapter-vercel@5.4.2

@sveltejs/adapter-vercel@5.4.3

@sveltejs/adapter-vercel@5.4.4

@sveltejs/adapter-vercel@5.4.5

@sveltejs/adapter-vercel@5.4.6

@sveltejs/adapter-vercel@5.4.7

@sveltejs/adapter-vercel@5.4.8

@sveltejs/adapter-vercel@5.5.0

@sveltejs/adapter-vercel@5.7.0

@sveltejs/adapter-vercel@5.7.1

@sveltejs/adapter-vercel@5.7.2

@sveltejs/adapter-vercel@5.8.0

@sveltejs/adapter-vercel@5.8.1

@sveltejs/adapter-vercel@5.8.2

@sveltejs/adapter-vercel@5.9.0

@sveltejs/adapter-vercel@5.9.1

@sveltejs/adapter-vercel@6.*

@sveltejs/adapter-vercel@6.0.0

@sveltejs/adapter-vercel@6.1.0

@sveltejs/adapter-vercel@6.1.1

@sveltejs/adapter-vercel@6.1.2

@sveltejs/adapter-vercel@6.2.0

@sveltejs/adapter-vercel@6.3.0

@sveltejs/amp@1.*

@sveltejs/amp@1.1.2

@sveltejs/amp@1.1.3

@sveltejs/amp@1.1.4

@sveltejs/amp@1.1.5

@sveltejs/enhanced-img@0.*

@sveltejs/enhanced-img@0.3.1

@sveltejs/enhanced-img@0.3.10

@sveltejs/enhanced-img@0.3.2

@sveltejs/enhanced-img@0.3.3

@sveltejs/enhanced-img@0.3.4

@sveltejs/enhanced-img@0.3.5

@sveltejs/enhanced-img@0.3.6

@sveltejs/enhanced-img@0.3.7

@sveltejs/enhanced-img@0.3.8

@sveltejs/enhanced-img@0.3.9

@sveltejs/enhanced-img@0.4.0

@sveltejs/enhanced-img@0.4.1

@sveltejs/enhanced-img@0.5.0

@sveltejs/enhanced-img@0.5.1

@sveltejs/enhanced-img@0.6.0

@sveltejs/enhanced-img@0.6.1

@sveltejs/enhanced-img@0.7.0

@sveltejs/enhanced-img@0.7.1

@sveltejs/enhanced-img@0.8.0

@sveltejs/enhanced-img@0.8.1

@sveltejs/enhanced-img@0.8.2

@sveltejs/enhanced-img@0.8.3

@sveltejs/enhanced-img@0.8.4

@sveltejs/enhanced-img@0.8.5

@sveltejs/enhanced-img@0.9.0

@sveltejs/enhanced-img@0.9.1

@sveltejs/enhanced-img@0.9.2

@sveltejs/kit@2.*

@sveltejs/kit@2.19.0

@sveltejs/kit@2.19.1

@sveltejs/kit@2.19.2

@sveltejs/kit@2.20.0

@sveltejs/kit@2.20.1

@sveltejs/kit@2.20.2

@sveltejs/kit@2.20.3

@sveltejs/kit@2.20.4

@sveltejs/kit@2.20.5

@sveltejs/kit@2.20.6

@sveltejs/kit@2.20.7

@sveltejs/kit@2.20.8

@sveltejs/kit@2.21.0

@sveltejs/kit@2.21.1

@sveltejs/kit@2.21.2

@sveltejs/kit@2.21.3

@sveltejs/kit@2.21.4

@sveltejs/kit@2.21.5

@sveltejs/kit@2.22.0

@sveltejs/kit@2.22.1

@sveltejs/kit@2.22.2

@sveltejs/kit@2.22.3

@sveltejs/kit@2.22.4

@sveltejs/kit@2.22.5

@sveltejs/kit@2.23.0

@sveltejs/kit@2.24.0

@sveltejs/kit@2.25.0

@sveltejs/kit@2.25.1

@sveltejs/kit@2.25.2

@sveltejs/kit@2.26.0

@sveltejs/kit@2.26.1

@sveltejs/kit@2.27.0

@sveltejs/kit@2.27.1

@sveltejs/kit@2.27.2

@sveltejs/kit@2.27.3

@sveltejs/kit@2.28.0

@sveltejs/kit@2.29.0

@sveltejs/kit@2.29.1

@sveltejs/kit@2.30.0

@sveltejs/kit@2.30.1

@sveltejs/kit@2.31.0

@sveltejs/kit@2.31.1

@sveltejs/kit@2.32.0

@sveltejs/kit@2.33.0

@sveltejs/kit@2.33.1

@sveltejs/kit@2.34.0

@sveltejs/kit@2.34.1

@sveltejs/kit@2.35.0

@sveltejs/kit@2.36.0

@sveltejs/kit@2.36.1

@sveltejs/kit@2.36.2

@sveltejs/kit@2.36.3

@sveltejs/kit@2.37.0

@sveltejs/kit@2.37.1

@sveltejs/kit@2.38.0

@sveltejs/kit@2.38.1

@sveltejs/kit@2.39.0

@sveltejs/kit@2.39.1

@sveltejs/kit@2.40.0

@sveltejs/kit@2.41.0

@sveltejs/kit@2.42.0

@sveltejs/kit@2.42.1

@sveltejs/kit@2.42.2

@sveltejs/kit@2.43.0

@sveltejs/kit@2.43.1

@sveltejs/kit@2.43.2

@sveltejs/kit@2.43.3

@sveltejs/kit@2.43.4

@sveltejs/kit@2.43.5

@sveltejs/kit@2.43.6

@sveltejs/kit@2.43.7

@sveltejs/kit@2.43.8

@sveltejs/kit@2.44.0

@sveltejs/kit@2.45.0

@sveltejs/kit@2.46.0

@sveltejs/kit@2.46.1

@sveltejs/kit@2.46.2

@sveltejs/kit@2.46.3

@sveltejs/kit@2.46.4

@sveltejs/kit@2.46.5

@sveltejs/kit@2.47.0

@sveltejs/kit@2.47.1

@sveltejs/kit@2.47.2

@sveltejs/kit@2.47.3

@sveltejs/kit@2.48.0

@sveltejs/kit@2.48.1

@sveltejs/kit@2.48.2

@sveltejs/kit@2.48.3

@sveltejs/kit@2.48.4

@sveltejs/kit@2.48.5

@sveltejs/kit@2.48.6

@sveltejs/kit@2.48.7

@sveltejs/kit@2.48.8

@sveltejs/kit@2.49.0

@sveltejs/kit@2.49.1

@sveltejs/kit@2.49.2

@sveltejs/kit@2.49.3

@sveltejs/kit@2.49.4

@sveltejs/kit@2.5.19

@sveltejs/kit@2.5.20

@sveltejs/kit@2.5.21

@sveltejs/kit@2.5.22

@sveltejs/kit@2.5.23

@sveltejs/kit@2.5.24

@sveltejs/kit@2.5.25

@sveltejs/kit@2.5.26

@sveltejs/kit@2.5.27

@sveltejs/kit@2.5.28

@sveltejs/kit@2.6.0

@sveltejs/kit@2.6.1

@sveltejs/kit@2.6.2

@sveltejs/kit@2.6.3

@sveltejs/kit@2.6.4

@sveltejs/kit@2.7.0

@sveltejs/kit@2.7.1

@sveltejs/kit@2.7.2

@sveltejs/kit@2.7.3

@sveltejs/kit@2.7.4

@sveltejs/kit@2.7.5

@sveltejs/kit@2.7.6

@sveltejs/kit@2.7.7

@sveltejs/kit@2.8.0

@sveltejs/kit@2.8.1

@sveltejs/kit@2.8.2

@sveltejs/kit@2.8.3

@sveltejs/kit@2.8.4

@sveltejs/kit@2.8.5

@sveltejs/kit@2.9.0

@sveltejs/package@2.*

@sveltejs/package@2.3.11

@sveltejs/package@2.3.12

@sveltejs/package@2.3.3

@sveltejs/package@2.3.4

@sveltejs/package@2.3.5

@sveltejs/package@2.3.7

@sveltejs/package@2.4.0

@sveltejs/package@2.4.1

@sveltejs/package@2.5.0

@sveltejs/package@2.5.1

@sveltejs/package@2.5.2

@sveltejs/package@2.5.3

@sveltejs/package@2.5.4

@sveltejs/package@2.5.5

@sveltejs/package@2.5.6

@sveltejs/package@2.5.7

create-svelte@6.*

create-svelte@6.3.10

create-svelte@6.3.11

create-svelte@6.3.12

create-svelte@6.3.4

create-svelte@6.3.5

create-svelte@6.3.6

create-svelte@6.3.7

create-svelte@6.3.8

create-svelte@6.3.9

create-svelte@6.4.0

create-svelte@7.*

create-svelte@7.0.0

create-svelte@7.0.1

svelte-migrate@1.*

svelte-migrate@1.4.4

svelte-migrate@1.4.5

svelte-migrate@1.5.0

svelte-migrate@1.5.1

svelte-migrate@1.6.0

svelte-migrate@1.6.1

svelte-migrate@1.6.2

svelte-migrate@1.6.3

svelte-migrate@1.6.4

svelte-migrate@1.6.6

svelte-migrate@1.6.7

svelte-migrate@1.6.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67647.json"