GitHub Advisoryadvisory · npm

GHSA-9pq4-5hcf-288c Cache poisoning in @sveltejs/adapter-vercel

MEDIUM Published 2026-02-19 Modified 2026-02-23 Official page ↗
Aliases
CVE-2026-27118
Ecosystem
npm
Packages
@sveltejs/adapter-vercel
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-346
Reviewed
2026-02-19

Affected packages

• npm @sveltejs/adapter-vercel: < 6.3.2 → fixed in 6.3.2

Description

Versions of `@sveltejs/adapter-vercel` prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users. Successful exploitation requires a victim to visit an attacker-controlled link while authenticated. Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible.

Related

Alias · CVE (1)

  • CVE-2026-27118 SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. vulnerability

Weakness · CWE (1)

  • CWE-346 Origin Validation Error weakness

References