Race Condition in SvelteKit Affects User Data Security
CVE-2026-82258

5.9MEDIUM

Key Information:

Vendor

Sveltejs

Status
Kit
Vendor
CVE Published:
28 August 2026

What is CVE-2026-82258?

SvelteKit versions from 2.38.0 leading up to 2.60.0 are affected by a race condition in the query.batch method, which permits concurrent requests from multiple users to consolidate under one request context. This vulnerability allows attackers to exploit specific timing scenarios, thus enabling the unauthorized access of sensitive data related to other users' concurrent requests.

Affected Version(s)

kit 2.38.0 < 2.60.1

kit 2.60.1

References

https://github.com/sveltejs/kit/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/sveltekit-2.38.0-bef...
third-party-advisory

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

rafabd1
elliott-with-the-longest-name-on-github
dummdidumm
.