Go to packages list

sveltejs-adapter-node

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 2HighAffects 4 versions
  • 0MediumAffects 0 versions
  • 1ModerateAffects 2 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High2 (66.7%)
  • Medium0 (0.0%)
  • Moderate1 (33.3%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting sveltejs-adapter-node, based on data from OSV.

Vulnerabilities affecting sveltejs-adapter-node
IDSeveritySummaryAffected versionsPublishedSource
GHSA-rqw3-x7hx-mm3pModerateSvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`In affected versions, `@sveltejs/adapter-node` can attempt to add a header to an immutable request in a context that causes the server to crash, denying service to any other requests routed to that server.
  • >= 5.5.7, < 5.5.8
  • >= 6.0.0-next.0, < 6.0.1
GitHub (opens in a new tab)
GHSA-j62c-4x62-9r35HighSvelteKit is vulnerable to denial of service and possible SSRF when using prerendering### Summary Versions of SvelteKit are vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. ### Details Affected versions from 2.44.0 onwards are vulnerable to DoS if: - your app has at least one prerendered route (`export const prerender = true`) Affected versions from 2.19.0 onwards are vulnerable to DoS and SSRF if: - your app has at least one prerendered route (`export const prerender = true`) - AND you are using `adapter-node` without a configured `ORIGIN` environment variable, and you are not using a reverse proxy that implements H
  • >= 5.4.1, < 5.5.1
GitHub (opens in a new tab)
GHSA-g5m6-hxpp-fc49HighSending a GET or HEAD request with a body crashes SvelteKit### Summary In SvelteKit 2 sending a GET request with a body eg `{}` to a SvelteKit app in preview or with `adapter-node` throws `Request with GET/HEAD method cannot have body.` and crashes the app. ``` node:internal/deps/undici/undici:6066 throw new TypeError("Request with GET/HEAD method cannot have body."); ^ TypeError: Request with GET/HEAD method cannot have body. at new Request (node:internal/deps/undici/undici:6066:17) at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/node/index.js:107:9) at file:///
  • >= 2.0.0, < 2.1.2
  • >= 3.0.0, < 3.0.3
  • >= 4.0.0, < 4.0.1
GitHub (opens in a new tab)
  • GHSA-rqw3-x7hx-mm3pModerate
    SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`
    • >= 5.5.7, < 5.5.8
    • >= 6.0.0-next.0, < 6.0.1
    GitHub (opens in a new tab)

    In affected versions, `@sveltejs/adapter-node` can attempt to add a header to an immutable request in a context that causes the server to crash, denying service to any other requests routed to that server.

    CVE: CVE-2026-128123

  • GHSA-j62c-4x62-9r35High
    SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
    • >= 5.4.1, < 5.5.1
    GitHub (opens in a new tab)

    ### Summary Versions of SvelteKit are vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. ### Details Affected versions from 2.44.0 onwards are vulnerable to DoS if: - your app has at least one prerendered route (`export const prerender = true`) Affected versions from 2.19.0 onwards are vulnerable to DoS and SSRF if: - your app has at least one prerendered route (`export const prerender = true`) - AND you are using `adapter-node` without a configured `ORIGIN` environment variable, and you are not using a reverse proxy that implements H

    CVE: CVE-2025-67647

  • GHSA-g5m6-hxpp-fc49High
    Sending a GET or HEAD request with a body crashes SvelteKit
    • >= 2.0.0, < 2.1.2
    • >= 3.0.0, < 3.0.3
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 2.0.0, < 2.1.2
    • >= 3.0.0, < 3.0.3
    • >= 4.0.0, < 4.0.1

    ### Summary In SvelteKit 2 sending a GET request with a body eg `{}` to a SvelteKit app in preview or with `adapter-node` throws `Request with GET/HEAD method cannot have body.` and crashes the app. ``` node:internal/deps/undici/undici:6066 throw new TypeError("Request with GET/HEAD method cannot have body."); ^ TypeError: Request with GET/HEAD method cannot have body. at new Request (node:internal/deps/undici/undici:6066:17) at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/node/index.js:107:9) at file:///

    CVE: CVE-2024-23641

Showing 1-3 of 3 vulnerabilities