Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users. Successful exploitation requires a victim to visit an attacker-controlled link while authenticated. Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible. This vulnerability is fixed in 6.3.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-20 | 1 | Patch1 |
| 2026-02-21 | 1 | Disclosure1 |
CVE-2026-27118 Cache Poisoning Vulnerability in SvelteKit Vercel Adapter Before 6.3.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27118
Post summary
The post cites a cache poisoning vulnerability in SvelteKit’s Vercel Adapter before version 6.3.2 and provides a link to additional details.
CVE-2026-27118 SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable t… https://www.cve.org/CVERecord?id=CVE-2026-27118
Post summary
CVE-2026-27118 affects older @sveltejs/adapter-vercel releases; upgrading to version 6.3.2 resolves the issue.