GitHub Advisoryadvisory · npm

GHSA-hgv7-v322-mmgr @sveltejs/kit: `query.batch` cross-talk

MEDIUM Published 2026-05-21 Modified 2026-07-01 Official page ↗
Ecosystem
npm
Packages
@sveltejs/kit
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-200
Reviewed
2026-05-21

Affected packages

• npm @sveltejs/kit: >= 2.38.0, < 2.60.1 → fixed in 2.60.1

Description

`query.batch()` could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References