Listen to this Post
How the CVE Works
The `query.batch` function, introduced in SvelteKit 2.38.0, is a performance feature designed to solve the “N+1 problem” by grouping multiple identical remote function calls that occur within the same JavaScript macrotask. Instead of sending separate HTTP requests, SvelteKit bundles them into a single batched request to the server. On the server side, the batched request’s callback receives an array of all inputs and must return an array of results in the same order.
The vulnerability arises from a race condition due to improper isolation of request contexts within the batching queue. Under specific, low-probability timing scenarios, the batching logic fails to correctly distinguish between concurrent requests from different users. As a result, user A’s request and user B’s request can be erroneously merged into the same batch. The batch is then resolved under a single request context, leading to a “cross-talk” effect. This can cause the data intended for user A to be returned to user B, or vice versa, resulting in direct cross-user data disclosure. The issue is extremely timing-sensitive and rare, but it compromises the fundamental security boundary between user sessions on a SvelteKit application.
DailyCVE Form
Platform: @sveltejs/kit
Version: 2.38.0 – 2.60.0
Vulnerability: Cross-user data disclosure / information leak
Severity: Moderate
Date: 2026-05-14
Prediction: Patch release on 2026-05-18
What Undercode Say
To check the current version of @sveltejs/kit in a project:
npm list @sveltejs/kit
To update the package to a secure version (2.60.1 or later):
npm install @sveltejs/kit@latest
For automated scanning and dependency upgrades in CI/CD, use:
npm audit fix --force
How Exploit
An attacker can attempt to trigger the race condition by sending numerous concurrent requests that invoke the same `query.batch` function. The attacker would need to manipulate the timing of these requests so that the batching mechanism “confuses” the request contexts. Successful exploitation would result in the server returning data from a different user’s request to the attacker, allowing the attacker to view information they are not authorized to access.
Protection from this CVE
The primary protection is to upgrade the @sveltejs/kit package to version 2.60.1 or higher. This version includes a patch that properly isolates the batching queue’s request contexts, eliminating the cross-talk condition. As a temporary workaround, applications can disable the use of `query.batch` functions, falling back to standard `query` functions, which do not exhibit this race condition.
Impact
The impact is a direct breach of data confidentiality. An attacker who successfully exploits this vulnerability can view the data of another user, potentially including sensitive information such as personal details, authentication tokens, or other private data. The vulnerability does not allow for data modification or privilege escalation, but the unauthorized access to private user data is a high-impact security breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
