SvelteKit

@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass

@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service

SvelteKit vulnerable to Cross-Site Request Forgery

@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params

CPU exhaustion in SvelteKit remote form deserialization (experimental only)

SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)

Sending a GET or HEAD request with a body crashes SvelteKit

SvelteKit framework has Insufficient CSRF protection for CORS requests

@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)

SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering