CVE-2026-82258: SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch
Published Aug 28, 2026
·Updated
SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.
Affected Software
1 affected component
SvelteKit>=2.38.0<2.60.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SvelteKitto a version that resolves this vulnerability.Fixed in 2.60.1
Event History
Aug 28, 2026
CVE Published
via MITRE·10:49 AM
Data Sourced
via MITRE·10:49 AM
DescriptionWeakness