CVE-2026-66062: SvelteKit DoS Vulnerability

CVE-2026-66062 Overview

CVE-2026-66062 is a Regular Expression Denial of Service (ReDoS) vulnerability in SvelteKit, a framework for building web applications with Svelte. The flaw affects the content negotiation header parser used by SvelteKit's request handling. The regular expression parsing Accept and similar headers is vulnerable to quadratic backtracking. A remote attacker can send a crafted header value to trigger excessive CPU consumption, degrading or denying service. The issue is classified as [CWE-1333] Inefficient Regular Expression Complexity. Version 2.70.2 remediates the vulnerability.

Critical Impact
Unauthenticated remote attackers can exhaust server CPU resources through malicious HTTP header values, causing partial or full denial of service on SvelteKit applications.

Affected Products

SvelteKit versions prior to 2.70.2
Applications using @sveltejs/kit for server-side request handling
Node.js and edge-runtime deployments relying on SvelteKit content negotiation

Discovery Timeline

2026-08-07 - CVE-2026-66062 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-66062

Vulnerability Analysis

The vulnerability resides in packages/kit/src/utils/http.js, where SvelteKit parses HTTP content negotiation headers such as Accept. The parser splits the header on commas and applies a regular expression to extract media type, subtype, and quality value. The unanchored pattern permits ambiguous matching against the leading whitespace and token characters, enabling catastrophic backtracking on crafted inputs.

An attacker sends a request containing a specially constructed Accept header value. The regex engine attempts many overlapping match paths before rejecting the input. Processing time grows quadratically with input length, blocking the event loop and starving other requests on the same worker.

The attack requires no authentication and no user interaction. Because SvelteKit invokes the parser on standard request paths, any exposed endpoint that receives HTTP requests is reachable.

Root Cause

The regular expression /([^/ \t]+)\/([^; \t]+)[ \t]*(?:;[ \t]*q=([0-9.]+))?/ lacks a start anchor. Without ^, the engine retries matches at every position in the string when the first attempt fails. Combined with the character-class token [^/ \t]+, this creates the quadratic backtracking pattern.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends requests containing malicious values in headers processed by the content negotiation parser. No credentials or prior access are required.

javascript

// Patch in packages/kit/src/utils/http.js
 	const parts = [];
 
 	accept.split(',').forEach((str, i) => {
-		const match = /([^/ \t]+)\/([^; \t]+)[ \t]*(?:;[ \t]*q=([0-9.]+))?/.exec(str);
+		const match = /^[ \t]*([^/ \t]+)\/([^; \t]+)[ \t]*(?:;[ \t]*q=([0-9.]+))?/.exec(str);
 
 		// no match equals invalid header — ignore
 		if (match) {

The fix adds a ^[ \t]* prefix, anchoring the pattern to the start of each comma-separated segment. This prevents the engine from retrying matches at arbitrary offsets and eliminates the quadratic backtracking behavior. Source: GitHub Commit 82712fc.

Detection Methods for CVE-2026-66062

Indicators of Compromise

Sustained CPU saturation on Node.js worker processes handling SvelteKit traffic
HTTP requests with unusually long or repetitive Accept, Accept-Language, or Accept-Encoding header values
Increased request latency and timeouts across unrelated endpoints on the same instance
Event loop lag warnings in application performance monitoring telemetry

Detection Strategies

Instrument web application firewalls to flag inbound headers exceeding reasonable length thresholds, for example 8 KB for Accept
Add regex complexity scanning against inbound header values using bounded matchers before they reach application code
Correlate spikes in per-request CPU time with source IP addresses to identify probing attempts

Monitoring Recommendations

Track process.cpuUsage() and event loop delay metrics per SvelteKit worker
Alert on repeated 5xx responses or gateway timeouts originating from a small set of client IPs
Log full request headers on slow requests to support post-incident analysis

How to Mitigate CVE-2026-66062

Immediate Actions Required

Upgrade @sveltejs/kit to version 2.70.2 or later across all environments
Audit dependency lockfiles and CI pipelines to confirm the patched version is deployed
Deploy header length limits at the reverse proxy or CDN layer as a defense-in-depth measure

Patch Information

The fix is available in @sveltejs/kit version 2.70.2. See the GitHub Release Notes and the GitHub Security Advisory GHSA-29g2-3rmr-qm68 for details. The patch anchors the content negotiation regex to prevent backtracking.

Workarounds

Configure the upstream proxy such as NGINX or Cloudflare to enforce a maximum length on Accept, Accept-Language, and Accept-Encoding headers
Apply per-client rate limiting to reduce the impact of repeated malicious requests
Deploy a WAF rule that drops requests with header values matching known ReDoS payload patterns

bash

# NGINX example: cap request header size and reject oversized Accept headers
http {
    large_client_header_buffers 4 8k;
    client_header_buffer_size 4k;

    map $http_accept $block_long_accept {
        default 0;
        "~^.{2048,}$" 1;
    }

    server {
        if ($block_long_accept) {
            return 400;
        }
    }
}