medium4.8
CVE-2026-82258
SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a sing…
Impact
SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Svelte | Sveltekit | from 2.38.0 before 2.60.1 |