CVE-2026-82258

EUVD-2026-67584
SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.
Race Condition
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.8 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 13.3%
Affected Products (NVD)
VendorProductVersion
sveltesveltekit
2.38.0 ≤
𝑥
< 2.60.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr
https://www.vulncheck.com/advisories/sveltekit-2.38.0-before-2.60.1-cross-user-data-disclosure-via-query-batch