{"id":"CVE-2025-67647","summary":"SvelteKit Denial of service and possible SSRF when using prerendering","details":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. This vulnerability is fixed in 2.49.5.","aliases":["GHSA-j62c-4x62-9r35"],"modified":"2026-08-12T03:51:22.549003515Z","published":"2026-01-15T18:33:25.295Z","database_specific":{"cwe_ids":["CWE-248","CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67647.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67647.json"},{"type":"ADVISORY","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-j62c-4x62-9r35"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67647"},{"type":"FIX","url":"https://github.com/sveltejs/kit/commit/d9ae9b00b14f5574d109f3fd548f960594346226"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sveltejs/kit","events":[{"introduced":"43544107269013e8b5160d268da25f1e003b6f6f"},{"fixed":"c89805e4a4af14859d44f625bd83344e3d1a08b0"},{"introduced":"d6f9beb825034ba239eed2d5e76fcb728fb8369f"},{"fixed":"80ffb53382e397a8fc83e6b63d2675eeabb427bd"},{"fixed":"d9ae9b00b14f5574d109f3fd548f960594346226"}],"database_specific":{"cpe":["cpe:2.3:a:svelte:adapter-node:*:*:*:*:*:node.js:*:*","cpe:2.3:a:svelte:kit:*:*:*:*:*:node.js:*:*"],"extracted_events":[{"introduced":"5.4.1"},{"fixed":"5.5.1"},{"introduced":"2.19.0"},{"fixed":"2.49.5"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["@sveltejs/adapter-node@5.5.0","@sveltejs/kit@2.49.4","@sveltejs/kit@2.49.3","@sveltejs/adapter-vercel@6.3.0","@sveltejs/kit@2.49.2","@sveltejs/kit@2.49.1","@sveltejs/package@2.5.7","@sveltejs/enhanced-img@0.9.2","@sveltejs/adapter-vercel@6.2.0","@sveltejs/enhanced-img@0.9.1","@sveltejs/kit@2.49.0","@sveltejs/kit@2.48.8","@sveltejs/enhanced-img@0.9.0","@sveltejs/package@2.5.6","@sveltejs/kit@2.48.7","@sveltejs/adapter-vercel@6.1.2","@sveltejs/package@2.5.5","@sveltejs/kit@2.48.6","@sveltejs/kit@2.48.5","@sveltejs/enhanced-img@0.8.5","@sveltejs/kit@2.48.4","@sveltejs/kit@2.48.3","@sveltejs/adapter-vercel@6.1.1","@sveltejs/kit@2.48.2","@sveltejs/kit@2.48.1","@sveltejs/adapter-vercel@6.1.0","@sveltejs/kit@2.48.0","@sveltejs/kit@2.47.3","@sveltejs/kit@2.47.2","@sveltejs/kit@2.47.1","@sveltejs/adapter-auto@7.0.0","@sveltejs/kit@2.47.0","@sveltejs/adapter-vercel@6.0.0","@sveltejs/adapter-node@5.4.0","@sveltejs/kit@2.46.5","@sveltejs/kit@2.46.4","@sveltejs/kit@2.46.3","@sveltejs/kit@2.46.2","@sveltejs/kit@2.46.1","@sveltejs/kit@2.46.0","@sveltejs/kit@2.45.0","@sveltejs/kit@2.44.0","@sveltejs/enhanced-img@0.8.4","@sveltejs/kit@2.43.8","@sveltejs/enhanced-img@0.8.3","@sveltejs/adapter-vercel@5.10.3","@sveltejs/adapter-static@3.0.10","@sveltejs/adapter-node@5.3.3","@sveltejs/adapter-netlify@5.2.4","@sveltejs/adapter-cloudflare@7.2.4","@sveltejs/adapter-auto@6.1.1","@sveltejs/kit@2.43.7","@sveltejs/kit@2.43.6","@sveltejs/kit@2.43.5","@sveltejs/kit@2.43.4","@sveltejs/kit@2.43.3","@sveltejs/enhanced-img@0.8.2","@sveltejs/package@2.5.4","@sveltejs/kit@2.43.2","@sveltejs/kit@2.43.1","@sveltejs/kit@2.43.0","@sveltejs/package@2.5.3","@sveltejs/kit@2.42.2","@sveltejs/kit@2.42.1","@sveltejs/kit@2.42.0","@sveltejs/kit@2.41.0","@sveltejs/package@2.5.2","@sveltejs/kit@2.40.0","@sveltejs/package@2.5.1","@sveltejs/kit@2.39.1","@sveltejs/kit@2.39.0","@sveltejs/kit@2.38.1","@sveltejs/kit@2.38.0","@sveltejs/adapter-node@5.3.2","@sveltejs/kit@2.37.1","@sveltejs/kit@2.37.0","@sveltejs/kit@2.36.3","@sveltejs/adapter-netlify@5.2.3","@sveltejs/adapter-cloudflare@7.2.3","@sveltejs/kit@2.36.2","@sveltejs/kit@2.36.1","@sveltejs/kit@2.36.0","@sveltejs/package@2.5.0","@sveltejs/kit@2.35.0","@sveltejs/kit@2.34.1","@sveltejs/adapter-cloudflare@7.2.2","@sveltejs/kit@2.34.0","@sveltejs/kit@2.33.1","@sveltejs/adapter-vercel@5.10.2","@sveltejs/adapter-netlify@5.2.2","@sveltejs/adapter-vercel@5.10.1","@sveltejs/kit@2.33.0","@sveltejs/kit@2.32.0","@sveltejs/enhanced-img@0.8.1","@sveltejs/adapter-vercel@5.10.0","@sveltejs/kit@2.31.1","@sveltejs/adapter-vercel@5.9.1","@sveltejs/adapter-node@5.3.1","@sveltejs/adapter-netlify@5.2.1","@sveltejs/adapter-cloudflare@7.2.1","@sveltejs/kit@2.31.0","@sveltejs/adapter-vercel@5.9.0","@sveltejs/adapter-node@5.3.0","@sveltejs/adapter-netlify@5.2.0","@sveltejs/adapter-cloudflare@7.2.0","@sveltejs/kit@2.30.1","@sveltejs/adapter-node@5.2.16","@sveltejs/kit@2.30.0","@sveltejs/adapter-node@5.2.15","@sveltejs/kit@2.29.1","@sveltejs/kit@2.29.0","@sveltejs/kit@2.28.0","@sveltejs/enhanced-img@0.8.0","@sveltejs/adapter-auto@6.1.0","create-svelte@7.0.1","@sveltejs/package@2.4.1","@sveltejs/kit@2.27.3","@sveltejs/enhanced-img@0.7.1","@sveltejs/amp@1.1.5","@sveltejs/adapter-vercel@5.8.2","@sveltejs/adapter-static@3.0.9","@sveltejs/adapter-node@5.2.14","@sveltejs/adapter-netlify@5.1.1","@sveltejs/adapter-cloudflare@7.1.3","@sveltejs/adapter-auto@6.0.2","@sveltejs/kit@2.27.2","@sveltejs/kit@2.27.1","@sveltejs/kit@2.27.0","@sveltejs/adapter-cloudflare@7.1.2","@sveltejs/kit@2.26.1","@sveltejs/adapter-vercel@5.8.1","@sveltejs/kit@2.26.0","@sveltejs/kit@2.25.2","@sveltejs/adapter-cloudflare@7.1.1","@sveltejs/kit@2.25.1","@sveltejs/kit@2.25.0","@sveltejs/adapter-vercel@5.8.0","@sveltejs/adapter-netlify@5.1.0","@sveltejs/adapter-cloudflare@7.1.0","@sveltejs/kit@2.24.0","@sveltejs/package@2.4.0","@sveltejs/kit@2.23.0","@sveltejs/enhanced-img@0.7.0","@sveltejs/kit@2.22.5","@sveltejs/kit@2.22.4","@sveltejs/kit@2.22.3","@sveltejs/adapter-node@5.2.13","@sveltejs/adapter-cloudflare@7.0.5","@sveltejs/kit@2.22.2","@sveltejs/package@2.3.12","@sveltejs/kit@2.22.1","@sveltejs/enhanced-img@0.6.1","@sveltejs/kit@2.22.0","@sveltejs/kit@2.21.5","@sveltejs/kit@2.21.4","@sveltejs/kit@2.21.3","@sveltejs/adapter-cloudflare@7.0.4","@sveltejs/kit@2.21.2","@sveltejs/kit@2.21.1","@sveltejs/kit@2.21.0","@sveltejs/enhanced-img@0.6.0","@sveltejs/adapter-auto@6.0.1","@sveltejs/enhanced-img@0.5.1","@sveltejs/adapter-vercel@5.7.2","@sveltejs/adapter-netlify@5.0.2","@sveltejs/adapter-cloudflare@7.0.3","@sveltejs/enhanced-img@0.5.0","@sveltejs/kit@2.20.8","@sveltejs/adapter-vercel@5.7.1","@sveltejs/adapter-netlify@5.0.1","@sveltejs/adapter-cloudflare@7.0.2","@sveltejs/kit@2.20.7","@sveltejs/kit@2.20.6","@sveltejs/package@2.3.11","@sveltejs/kit@2.20.5","@sveltejs/kit@2.20.4","@sveltejs/adapter-vercel@5.7.0","@sveltejs/adapter-cloudflare@7.0.1","@sveltejs/adapter-auto@6.0.0","@sveltejs/kit@2.20.3","@sveltejs/adapter-cloudflare@7.0.0","@sveltejs/adapter-cloudflare@6.0.1","@sveltejs/kit@2.20.2","@sveltejs/adapter-netlify@5.0.0","@sveltejs/adapter-cloudflare@6.0.0","@sveltejs/adapter-auto@5.0.0","@sveltejs/kit@2.20.1","@sveltejs/kit@2.20.0","@sveltejs/kit@2.19.2","@sveltejs/adapter-cloudflare@5.1.0","@sveltejs/adapter-cloudflare-workers@2.9.0","@sveltejs/kit@2.19.1","@sveltejs/kit@2.19.0","@sveltejs/kit@2.9.0","@sveltejs/adapter-vercel@5.5.0","@sveltejs/adapter-netlify@4.4.0","@sveltejs/adapter-cloudflare@4.8.0","@sveltejs/adapter-cloudflare-workers@2.6.0","@sveltejs/kit@2.8.4","@sveltejs/kit@2.8.5","@sveltejs/kit@2.8.3","@sveltejs/kit@2.8.2","@sveltejs/adapter-vercel@5.4.8","@sveltejs/kit@2.8.1","@sveltejs/kit@2.8.0","@sveltejs/adapter-vercel@5.4.7","@sveltejs/kit@2.7.7","@sveltejs/kit@2.7.6","@sveltejs/kit@2.7.5","@sveltejs/enhanced-img@0.4.1","svelte-migrate@1.6.8","svelte-migrate@1.6.7","@sveltejs/kit@2.7.4","@sveltejs/enhanced-img@0.4.0","svelte-migrate@1.6.6","@sveltejs/package@2.3.7","@sveltejs/kit@2.7.3","@sveltejs/enhanced-img@0.3.10","@sveltejs/amp@1.1.4","@sveltejs/adapter-vercel@5.4.6","@sveltejs/adapter-static@3.0.6","@sveltejs/adapter-node@5.2.9","@sveltejs/adapter-netlify@4.3.6","@sveltejs/adapter-cloudflare@4.7.4","@sveltejs/adapter-cloudflare-workers@2.5.6","@sveltejs/adapter-auto@3.3.1","create-svelte@7.0.0","svelte-migrate@1.6.4","@sveltejs/kit@2.7.2","svelte-migrate@1.6.3","@sveltejs/adapter-node@5.2.8","@sveltejs/kit@2.7.1","@sveltejs/adapter-node@5.2.7","create-svelte@6.4.0","@sveltejs/kit@2.7.0","@sveltejs/enhanced-img@0.3.9","@sveltejs/adapter-netlify@4.3.5","@sveltejs/adapter-cloudflare@4.7.3","@sveltejs/adapter-cloudflare-workers@2.5.5","@sveltejs/adapter-node@5.2.6","svelte-migrate@1.6.2","svelte-migrate@1.6.1","@sveltejs/kit@2.6.4","@sveltejs/kit@2.6.3","@sveltejs/adapter-vercel@5.4.5","svelte-migrate@1.6.0","@sveltejs/kit@2.6.2","svelte-migrate@1.5.1","svelte-migrate@1.5.0","@sveltejs/kit@2.6.1","create-svelte@6.3.12","@sveltejs/kit@2.6.0","@sveltejs/adapter-node@5.2.5","@sveltejs/adapter-node@5.2.4","create-svelte@6.3.11","@sveltejs/kit@2.5.28","@sveltejs/enhanced-img@0.3.8","@sveltejs/adapter-vercel@5.4.4","@sveltejs/adapter-static@3.0.5","@sveltejs/adapter-node@5.2.3","@sveltejs/adapter-netlify@4.3.4","@sveltejs/adapter-auto@3.2.5","@sveltejs/enhanced-img@0.3.7","@sveltejs/enhanced-img@0.3.6","@sveltejs/package@2.3.5","@sveltejs/kit@2.5.27","@sveltejs/enhanced-img@0.3.5","create-svelte@6.3.10","@sveltejs/kit@2.5.26","create-svelte@6.3.9","@sveltejs/kit@2.5.25","@sveltejs/enhanced-img@0.3.4","@sveltejs/kit@2.5.24","create-svelte@6.3.8","@sveltejs/kit@2.5.23","svelte-migrate@1.4.5","create-svelte@6.3.7","@sveltejs/package@2.3.4","@sveltejs/kit@2.5.22","@sveltejs/enhanced-img@0.3.3","@sveltejs/amp@1.1.3","@sveltejs/adapter-vercel@5.4.3","@sveltejs/adapter-static@3.0.4","@sveltejs/adapter-node@5.2.2","@sveltejs/adapter-netlify@4.3.3","@sveltejs/adapter-cloudflare@4.7.2","@sveltejs/adapter-cloudflare-workers@2.5.4","@sveltejs/adapter-auto@3.2.4","svelte-migrate@1.4.4","create-svelte@6.3.6","@sveltejs/package@2.3.3","@sveltejs/kit@2.5.21","@sveltejs/enhanced-img@0.3.2","@sveltejs/amp@1.1.2","@sveltejs/adapter-vercel@5.4.2","@sveltejs/adapter-static@3.0.3","@sveltejs/adapter-node@5.2.1","@sveltejs/adapter-netlify@4.3.2","@sveltejs/adapter-cloudflare@4.7.1","@sveltejs/adapter-cloudflare-workers@2.5.3","@sveltejs/adapter-auto@3.2.3","@sveltejs/kit@2.5.20","@sveltejs/kit@2.5.19","create-svelte@6.3.5","create-svelte@6.3.4","@sveltejs/enhanced-img@0.3.1","@sveltejs/adapter-cloudflare@4.7.0","@sveltejs/adapter-cloudflare-workers@2.5.2","@sveltejs/adapter-vercel@5.4.1","@sveltejs/adapter-netlify@4.3.1","@sveltejs/adapter-cloudflare@4.6.1","@sveltejs/adapter-cloudflare-workers@2.5.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67647.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:N"}]}