{"id":"CVE-2026-82258","summary":"SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch","details":"SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.","aliases":["GHSA-hgv7-v322-mmgr"],"modified":"2026-08-30T03:48:23.179769563Z","published":"2026-08-28T10:49:42.085Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82258.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-362"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82258.json"},{"type":"ADVISORY","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82258"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/sveltekit-2.38.0-before-2.60.1-cross-user-data-disclosure-via-query-batch"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sveltejs/kit","events":[{"introduced":"54e10cf07ab2bf06c6ec6d2ea225c34936c5d2e8"},{"fixed":"d0204067efe97ac2199845ca6fe54cce62f3f5de"}],"database_specific":{"extracted_events":[{"introduced":"2.38.0"},{"fixed":"2.60.1"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["@sveltejs/kit@2.60.0","@sveltejs/kit@2.59.1","@sveltejs/kit@2.59.0","@sveltejs/kit@2.58.0","@sveltejs/kit@2.57.1","@sveltejs/kit@2.57.0","@sveltejs/kit@2.56.1","@sveltejs/kit@2.56.0","@sveltejs/kit@2.55.0","@sveltejs/enhanced-img@0.10.4","@sveltejs/kit@2.54.0","@sveltejs/kit@2.53.4","@sveltejs/kit@2.53.3","@sveltejs/adapter-node@5.5.4","@sveltejs/kit@2.53.2","@sveltejs/kit@2.53.1","@sveltejs/adapter-vercel@6.3.3","@sveltejs/adapter-netlify@6.0.4","@sveltejs/adapter-netlify@6.0.3","@sveltejs/kit@2.53.0","@sveltejs/enhanced-img@0.10.3","@sveltejs/kit@2.52.2","@sveltejs/adapter-vercel@6.3.2","@sveltejs/adapter-netlify@6.0.2","@sveltejs/adapter-cloudflare@7.2.8","@sveltejs/kit@2.52.0","@sveltejs/adapter-auto@7.0.1","@sveltejs/enhanced-img@0.10.2","@sveltejs/kit@2.51.0","@sveltejs/enhanced-img@0.10.1","@sveltejs/adapter-node@5.5.3","@sveltejs/adapter-netlify@6.0.0","@sveltejs/adapter-cloudflare@7.2.7","@sveltejs/kit@2.50.2","@sveltejs/enhanced-img@0.10.0","@sveltejs/kit@2.50.1","@sveltejs/adapter-vercel@6.3.1","@sveltejs/adapter-node@5.5.2","@sveltejs/adapter-cloudflare@7.2.6","@sveltejs/kit@2.50.0","@sveltejs/enhanced-img@0.9.3","@sveltejs/kit@2.49.5","@sveltejs/adapter-node@5.5.1","@sveltejs/adapter-cloudflare@7.2.5","@sveltejs/adapter-node@5.5.0","@sveltejs/kit@2.49.4","@sveltejs/kit@2.49.3","@sveltejs/adapter-vercel@6.3.0","@sveltejs/kit@2.49.2","@sveltejs/kit@2.49.1","@sveltejs/package@2.5.7","@sveltejs/enhanced-img@0.9.2","@sveltejs/adapter-vercel@6.2.0","@sveltejs/enhanced-img@0.9.1","@sveltejs/kit@2.49.0","@sveltejs/kit@2.48.8","@sveltejs/enhanced-img@0.9.0","@sveltejs/package@2.5.6","@sveltejs/kit@2.48.7","@sveltejs/adapter-vercel@6.1.2","@sveltejs/package@2.5.5","@sveltejs/kit@2.48.6","@sveltejs/kit@2.48.5","@sveltejs/enhanced-img@0.8.5","@sveltejs/kit@2.48.4","@sveltejs/kit@2.48.3","@sveltejs/adapter-vercel@6.1.1","@sveltejs/kit@2.48.2","@sveltejs/kit@2.48.1","@sveltejs/adapter-vercel@6.1.0","@sveltejs/kit@2.48.0","@sveltejs/kit@2.47.3","@sveltejs/kit@2.47.2","@sveltejs/kit@2.47.1","@sveltejs/adapter-auto@7.0.0","@sveltejs/kit@2.47.0","@sveltejs/adapter-vercel@6.0.0","@sveltejs/adapter-node@5.4.0","@sveltejs/kit@2.46.5","@sveltejs/kit@2.46.4","@sveltejs/kit@2.46.3","@sveltejs/kit@2.46.2","@sveltejs/kit@2.46.1","@sveltejs/kit@2.46.0","@sveltejs/kit@2.45.0","@sveltejs/kit@2.44.0","@sveltejs/enhanced-img@0.8.4","@sveltejs/kit@2.43.8","@sveltejs/enhanced-img@0.8.3","@sveltejs/adapter-vercel@5.10.3","@sveltejs/adapter-static@3.0.10","@sveltejs/adapter-node@5.3.3","@sveltejs/adapter-netlify@5.2.4","@sveltejs/adapter-cloudflare@7.2.4","@sveltejs/adapter-auto@6.1.1","@sveltejs/kit@2.43.7","@sveltejs/kit@2.43.6","@sveltejs/kit@2.43.5","@sveltejs/kit@2.43.4","@sveltejs/kit@2.43.3","@sveltejs/enhanced-img@0.8.2","@sveltejs/package@2.5.4","@sveltejs/kit@2.43.2","@sveltejs/kit@2.43.1","@sveltejs/kit@2.43.0","@sveltejs/package@2.5.3","@sveltejs/kit@2.42.2","@sveltejs/kit@2.42.1","@sveltejs/kit@2.42.0","@sveltejs/kit@2.41.0","@sveltejs/package@2.5.2","@sveltejs/kit@2.40.0","@sveltejs/package@2.5.1","@sveltejs/kit@2.39.1","@sveltejs/kit@2.39.0","@sveltejs/kit@2.38.1","@sveltejs/kit@2.38.0","@sveltejs/adapter-node@5.3.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82258.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}]}