CVE-2025-67647

CRITICAL

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of serv...

Affects 2 products across 1 vendor.

CVSS 3.19.1
CVSS v48.4
EPSS0.5%
Percentile43th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-248: CWE-248
CWE-918: Server-Side Request Forgery (SSRF)

Attacker causes the server to make HTTP requests to attacker-chosen destinations, potentially reaching internal services.

Related Attack Patterns (CAPEC)
CAPEC-664 Server Side Request Forgery
via CWE-918

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

SvelteKit versions prior to 2.49.5 are vulnerable to server side request forgery (SSRF) and denial of service (DoS) under specific conditions. The DoS vulnerability affects applications with at least one prerendered route.

BSID: BS-2026-GLOBAL-277131-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-67647?
SvelteKit versions prior to 2.49.5 are vulnerable to server side request forgery (SSRF) and denial of service (DoS) under specific conditions. The DoS vulnerability affects applications with at least one prerendered route.
What is the CVSS score for CVE-2025-67647?
CVE-2025-67647 has CVSS 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS: 0.5%.
Is CVE-2025-67647 actively exploited?
No confirmed active exploitation of CVE-2025-67647 as of 2026-09-25.
How do I remediate CVE-2025-67647?
Priority: HIGH.
What systems are affected by CVE-2025-67647?
CVE-2025-67647 affects Svelte Adapter-Node, Kit.
Vulnerability Details
CVE IDCVE-2025-67647
BSIDBS-2026-GLOBAL-277131-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Published2026-01-15
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
CWE-248Server-Side Request Forgery (SSRF)
SourceNVD
Official Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. This vulnerability is fixed in 2.49.5.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit the SSRF vulnerability to make the server make requests to arbitrary hosts and ports. The DoS vulnerability can be triggered by sending specific requests to the server, causing it to become unresponsive.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Svelte Adapter-Node ≥ 5.4.1, < 5.5.1
Svelte Kit ≥ 2.19.0, < 2.49.5
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 273 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash83279e077511c18eb907f8e0d3a582fe658ec1734e7a64c9edf0abb37e19d24754adb2a97b4e175db86c53507fc3ea9d9c348e0dfbc06a7bc652755298b2ec09
Related CVEs affecting Svelte
CVE-2023-29008 8.8 The SvelteKit framework offers developers an option to create simple REST API... CVE-2023-29003 8.8 SvelteKit is a web development framework. The SvelteKit framework offers deve... CVE-2021-29261 7.8 The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows ... CVE-2024-23641 7.5 SvelteKit is a web development kit. In SvelteKit 2, sending a GET request wit... CVE-2026-22774 7.5 Svelte devalue is a JavaScript library that serializes values into strings wh...
View all Svelte CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.1 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →