CVE-2026-66062

Name of the Vulnerable Software and Affected Versions SvelteKit versions prior to 2.70.2

Description The content negotiation header parser used in request handling is susceptible to a regular expression vulnerability known as quadratic backtracking. This occurs when a specifically crafted value in the Accept header causes the system to perform an excessive number of computations, leading to high CPU consumption. This can result in a denial of service (DoS), although the impact is often mitigated by default header length limits on many platforms.

Recommendations Update to version 2.70.2.