github.com/sveltejs/svelte
Submitted 8/4/2026, 10:25:55 AM · Status: ok
Risk grade
F
100 / 100
Findings
64
1 critical20 high42 medium1 low0 info0 on CISA KEV0ATT&CK
Showing 64 of 64 findings
Findings
- form-data uses unsafe random function in form-data for choosing boundarygrypeCVE-2025-7783EPSS 1.7%
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsgrypeCVE-2026-13149EPSS 0.3%
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashgrypeCVE-2026-14257EPSS 0.3%
- flatted vulnerable to unbounded recursion DoS in parse() revive phasegrypeCVE-2026-32141EPSS 0.8%
- form-data: CRLF injection in form-data via unescaped multipart field names and filenamesgrypeCVE-2026-12143EPSS 0.5%
- Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/SetgrypeCVE-2026-59880EPSS 0.4%
- Immutable.js `List` 32-bit trie overflow → unrecoverable DoSgrypeCVE-2026-59879EPSS 0.4%
- js-yaml: YAML merge-key chains can force quadratic CPU consumptiongrypeCVE-2026-59869EPSS 0.4%
- js-yaml: YAML merge-key chains can force quadratic CPU consumptiongrypeCVE-2026-59869EPSS 0.4%
- minimatch has a ReDoS via repeated wildcards with non-matching literal in patterngrypeCVE-2026-26996EPSS 0.5%
- minimatch has a ReDoS via repeated wildcards with non-matching literal in patterngrypeCVE-2026-26996EPSS 0.5%
- minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsgrypeCVE-2026-27903EPSS 0.5%
- minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsgrypeCVE-2026-27903EPSS 0.5%
- minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsgrypeCVE-2026-27904EPSS 0.5%
- minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsgrypeCVE-2026-27904EPSS 0.5%
- PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsgrypeCVE-2026-45623EPSS 0.5%
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosuregrype
- Prototype Pollution via parse() in NodeJS flattedgrypeCVE-2026-33228EPSS 0.8%
- Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()grype
- vite: `server.fs.deny` bypass on Windows alternate pathsgrypeCVE-2026-53571EPSS 0.6%
- ws: Memory exhaustion DoS from tiny fragments and data chunksgrypeCVE-2026-48779EPSS 0.8%
- ajv has ReDoS when using `$data` optiongrypeCVE-2025-69873EPSS 0.5%
- brace-expansion: Zero-step sequence causes process hang and memory exhaustiongrypeCVE-2026-33750EPSS 0.4%
- JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliasesgrypeCVE-2026-53550EPSS 0.4%
- JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliasesgrypeCVE-2026-53550EPSS 0.4%
- launch-editor: NTLMv2 hash disclosure via UNC path handling on WindowsgrypeCVE-2026-53632EPSS 0.4%
- PostCSS has XSS via Unescaped </style> in its CSS Stringify OutputgrypeCVE-2026-41305EPSS 0.2%
- Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objectsgrypeCVE-2026-34043EPSS 0.5%
- uuid: Missing buffer bounds check in v3/v5/v6 when buf is providedgrypeCVE-2026-41907EPSS 0.3%
- ws: Uninitialized memory disclosuregrypeCVE-2026-45736EPSS 0.8%
- yaml is vulnerable to Stack Overflow via deeply nested YAML collectionsgrypeCVE-2026-33532EPSS 0.5%
- ajv has ReDoS when using `$data` optionajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the `$data` option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax (`$data` reference), which is passed directly to the JavaS…osv-scannerCVE-2025-69873
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups### Summary brace-expansion's expand() exhibits exponential-time - O(2ⁿ) - behavior in the number of consecutive non-expanding {} groups. A short, all-ASCII input (~90 bytes/30 groups) blocks the calling thread for minutes; a slightly longer input hangs it effectively indefinitel…osv-scannerCVE-2026-13149
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining many brace groups, an attacker keeps the result count under `max` while making every result grow with the number of groups. Building `ma…osv-scannerCVE-2026-14257
- brace-expansion: Zero-step sequence causes process hang and memory exhaustion### Impact A brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. The loop in question: https://github.com/juliangruber/brace-expansion/blob/daa71bcb4…osv-scannerCVE-2026-33750
- esbuild allows arbitrary file read when running the development server on Windows### Summary The development server contains a path traversal vulnerability on Windows when serving files from `servedir`. Due to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instead of a Windows-aware path normalization function, it is possible…osv-scanner
- flatted vulnerable to unbounded recursion DoS in parse() revive phase## Summary flatted's `parse()` function uses a recursive `revive()` phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential `$` indices, the recursion depth is unbounded, causing a stack overflow that crashes…osv-scannerCVE-2026-32141
- form-data uses unsafe random function in form-data for choosing boundary### Summary form-data uses `Math.random()` to select a boundary value for multipart form-encoded data. This can lead to a security issue if an attacker: 1. can observe other values produced by Math.random in the target application, and 2. can control one field of a request made …osv-scannerCVE-2025-7783
- form-data: CRLF injection in form-data via unescaped multipart field names and filenames## Summary `form-data` builds `multipart/form-data` request bodies. Through v4.0.5, the `field` name passed to `FormData#append` and the `filename` option are concatenated directly into the `Content-Disposition` header with no escaping of CR (`\r`), LF (`\n`), or `"`. An applica…osv-scannerCVE-2026-12143
- Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set## Summary `Immutable.Map` and `Immutable.Set` keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly. The string hash is public and deterministic, so an attacker who controls the **keys** inserted into a Map can craft many keys that all collide…osv-scannerCVE-2026-59880
- Immutable.js `List` 32-bit trie overflow → unrecoverable DoS## Summary `List#set`, `List#setSize`, `List#setIn`, `List#updateIn` (and the functional `set` / `setIn` / `updateIn`) mishandle an index or size in the range `[2 ** 30, 2 ** 31)`: - On an **empty** `List` the operation enters an **uncatchable infinite loop** (a tight CPU spin;…osv-scannerCVE-2026-59879
- JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases### Summary A crafted YAML document can trigger algorithmic CPU exhaustion in `js-yaml` merge-key processing (`<<`) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event …osv-scannerCVE-2026-53550
- JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases### Summary A crafted YAML document can trigger algorithmic CPU exhaustion in `js-yaml` merge-key processing (`<<`) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event …osv-scannerCVE-2026-53550
- js-yaml: YAML merge-key chains can force quadratic CPU consumption### Impact js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one: ```yaml a0: &a0 { k0: 0 } a1: &a1 { <<: *a0, k1: 1 } a2: &a2 { <<: *a1, k2: 2 } a3: &a3 {…osv-scannerCVE-2026-59869
- js-yaml: YAML merge-key chains can force quadratic CPU consumption### Impact js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one: ```yaml a0: &a0 { k0: 0 } a1: &a1 { <<: *a0, k1: 1 } a2: &a2 { <<: *a1, k2: 2 } a3: &a3 {…osv-scannerCVE-2026-59869
- launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows### Summary The `launch-editor` NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB s…osv-scannerCVE-2026-53632
- minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern### Summary `minimatch` is vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive `*` wildcards followed by a literal character that doesn't appear in the test string. Each `*` compiles to a separate `[^/]*?` regex group, and when…osv-scannerCVE-2026-26996
- minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern### Summary `minimatch` is vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive `*` wildcards followed by a literal character that doesn't appear in the test string. Each `*` compiles to a separate `[^/]*?` regex group, and when…osv-scannerCVE-2026-26996
- minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments### Summary `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is …osv-scannerCVE-2026-27903
- minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments### Summary `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is …osv-scannerCVE-2026-27903
- minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions### Summary Nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a s…osv-scannerCVE-2026-27904
- minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions### Summary Nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a s…osv-scannerCVE-2026-27904
- PostCSS has XSS via Unescaped </style> in its CSS Stringify Output# PostCSS: XSS via Unescaped `</style>` in CSS Stringify Output ## Summary PostCSS v8.5.5 (latest) does not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS value…osv-scannerCVE-2026-41305
- PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments## Summary PostCSS's `PreviousMap` parses the `/*# sourceMappingURL=PATH */` comment from any CSS string passed to `process()` and dereferences `PATH` against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the…osv-scannerCVE-2026-45623
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure## Vulnerability Details **File**: `lib/previous-map.js` **Line**: 87-98 (`loadFile`), 129-144 (`loadMap`) ### Root Cause PostCSS auto-detects a `/*# sourceMappingURL=... */` comment inside the CSS text it is asked to parse and, unless the caller explicitly passes `map: false`…osv-scanner
- Prototype Pollution via parse() in NodeJS flatted--- **Summary** The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "\_\_prot…osv-scannerCVE-2026-33228
- Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects### Impact **What kind of vulnerability is it?** It is a **Denial of Service (DoS)** vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from `Array.prototype` but has a very large `length` property), the pro…osv-scannerCVE-2026-34043
- Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A simi…osv-scanner
- uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided### Summary The `v3()`, `v5()`, and `v6()` [API methods](https://github.com/uuidjs/uuid#api-summary) (not `uuid` release versions) accept external output buffers but do not reject out-of-range writes (small `buf` or large `offset`). By contrast, `v4()`, `v1()`, and `v7()` API …osv-scannerCVE-2026-41907
- vite: `server.fs.deny` bypass on Windows alternate paths### Summary The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows. ### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite de…osv-scannerCVE-2026-53571
- ws: Memory exhaustion DoS from tiny fragments and data chunks### Impact A high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, lea…osv-scannerCVE-2026-48779
- ws: Uninitialized memory disclosure### Impact The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. ### Proof of concept ```js import { deepStrictEqual } from 'node:assert'; import { WebSocket, WebSocketServer } from 'ws'; …osv-scannerCVE-2026-45736
- yaml is vulnerable to Stack Overflow via deeply nested YAML collectionsParsing a YAML document with `yaml` may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded`…osv-scannerCVE-2026-33532
This report is public.