@SVELTEJS/ADAPTER-NODE · GHSA-rqw3-x7hx-mm3p · Package
FIX → 6.0.1
The @sveltejs/adapter-node package can try to add a header to an immutable request in a way that crashes the Node server. An attacker can send crafted requests to stop the server from handling other requests.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that deploy a SvelteKit app with @sveltejs/adapter-node to a Node server and use fetch proxying through that server are exposed. Apps built with other adapters, static exports, or serverless targets do not run this package and can skip it.
Not affected if other-adapter, static-export
Who cares node, self-hosted, sveltekit
npm ls @sveltejs/adapter-node in the project to see the installed version.>= 5.5.7 and < 6.0.1.Upgrade to 6.0.1
@sveltejs/adapter-node 6.0.1In affected versions, @sveltejs/adapter-node can attempt to add a header to an immutable request in a context that causes the server to crash, denying service to any other requests routed to that server.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.