PT-2026-45230 · Npm · @Sveltejs/Kit

Publicado 2026-05-21 · Atualizado 2026-05-21

OSV

CVSS v4.0

5.9

Média

Vetor base

AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

query.batch() could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

GHSA-HGV7-V322-MMGR

Produtos afetados

@Sveltejs/Kit

Referências · 3

• https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr · Nota
• https://github.com/sveltejs/kit · Nota
• https://osv.dev/vulnerability/GHSA-hgv7-v322-mmgr · Aviso do Fabricante