Cache Poisoning Vulnerability in SvelteKit by Vercel

CVE-2026-27118

What is CVE-2026-27118?

SvelteKit, a popular framework for developing web applications, is susceptible to a cache poisoning issue identified in versions of @sveltejs/adapter-vercel prior to 6.3.2. This flaw allows an internal query parameter related to Incremental Static Regeneration (ISR) to be exposed across all routes, enabling attackers to cache sensitive, user-specific responses that could later be served to unsuspecting users. To exploit this vulnerability, an attacker must lure the victim into clicking a link controlled by them while they are authenticated. While existing deployments benefit from Vercel's Web Application Firewall (WAF) for protection, upgrading the affected package is crucial to mitigate this risk.

References