CVE-2026-128119: SvelteKit: Private `query.batch` functions could collide, producing unexpected parameter / function combinations
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applications using the experimental remote functions flag could assign the same generated identifier to separate non-exported query.batch functions. When those private functions shared a request batch, arguments intended for one function could be passed to another function, causing unexpected cross-function processing and possible disclosure of function arguments. This issue is fixed in 3.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SvelteKitto a version that resolves this vulnerability.Fixed in 3.1.1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using SvelteKit versions from 2.60.1 through before 3.1.1 are affected if they enable the experimental remote functions flag and use non-exported query.batch functions. Applications not using that experimental feature are not described as affected.
What conditions are required for the issue to occur?
Separate private query.batch functions must receive the same generated identifier and share a request batch. Under those conditions, arguments intended for one function can be processed by another function.
What is the security impact of a collision?
A collision can cause unexpected cross-function processing and may disclose arguments supplied to a private function. The provided severity vector indicates confidentiality impact without stated integrity or availability impact.
What should teams do to remediate the issue?
Upgrade SvelteKit to version 3.1.1, which fixes the issue. If an upgrade cannot be performed immediately, the provided information does not specify a workaround; prioritize reviewing use of the experimental remote functions flag and private query.batch functions.