{"id":"GHSA-rqw3-x7hx-mm3p","kind":"vulnerability","aliases":["GHSA-rqw3-x7hx-mm3p"],"related":[],"title":"`@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`","description":"In affected versions, `@sveltejs/adapter-node` can attempt to add a header to an immutable request in a context that causes the server to crash, denying service to any other requests routed to that server.","summary":"The @sveltejs/adapter-node package can try to add a header to an immutable request in a way that crashes the Node server. An attacker can send crafted requests to stop the server from handling other requests.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@sveltejs/adapter-node","fixed":["6.0.1"],"affected":">= 5.5.7, < 6.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-248","node","package","self-hosted","sveltekit"],"not_affected_if":["other-adapter","static-export"],"how_to_check":"- Run `npm ls @sveltejs/adapter-node` in the project to see the installed version.\n- Check that the version is not `>= 5.5.7` and `< 6.0.1`.","fix":"- `@sveltejs/adapter-node` `6.0.1`","status":"open","published_at":"2026-10-29T23:47:02+00:00","first_seen_at":"2026-11-09T22:53:16+00:00","triaged_at":"2026-11-09T22:56:16+00:00","updated_at":"2026-11-09T22:56:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T22:56:16Z","model":"claude-haiku-5-5","output":{"fix":"- `@sveltejs/adapter-node` `6.0.1`","reach":"internet","title":"SvelteKit adapter-node: certain proxied requests crash the server, denying service","impact":"low","summary":"The @sveltejs/adapter-node package can try to add a header to an immutable request in a way that crashes the Node server. An attacker can send crafted requests to stop the server from handling other requests.","audience":"developers","category":"package","nicknames":[],"who_cares":["sveltekit","self-hosted","node"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Server crashes, denying service to other requests routed to it.","analyst_note":"","how_to_check":"- Run `npm ls @sveltejs/adapter-node` in the project to see the installed version.\n- Check that the version is not `>= 5.5.7` and `< 6.0.1`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["other-adapter","static-export"],"who_is_affected":"Teams that deploy a SvelteKit app with @sveltejs/adapter-node to a Node server and use fetch proxying through that server are exposed. Apps built with other adapters, static exports, or serverless targets do not run this package and can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000706,"input_tokens":4606,"output_tokens":491,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-248':21B 'add':34B,70C 'affect':64C 'attack':50B 'attempt':68C 'caus':81C 'certain':5A 'context':79C 'craft':53B 'crash':2A,45B,85C 'cwe':20B 'deni':86C 'fetch':8A 'ghsa':10A,15A 'ghsa-rqw3-x7hx-mm3p':9A,14A 'handl':60B 'header':36B,72C 'host':26B 'immut':39B,75C 'mm3p':13A,18A 'node':22B,47B 'packag':23B,30B 'proxi':4A 'request':6A,40B,54B,62B,76C,91C 'rout':92C 'rqw3':11A,16A 'self':25B 'self-host':24B 'send':52B 'server':48B,58B,83C,95C 'servic':87C 'stop':56B 'sveltejs/adapter-node':1A,19A,29B,66C 'sveltekit':27B 'tri':32B 'version':65C 'via':7A 'way':43B 'x7hx':12A,17A","nicknames":[],"mitigations":[],"who_affected":"Teams that deploy a SvelteKit app with @sveltejs/adapter-node to a Node server and use fetch proxying through that server are exposed. Apps built with other adapters, static exports, or serverless targets do not run this package and can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["adapternode"],"ptokens":["adapter","node","sveltejs"],"labels":["cwe248","medium","node","npm","package","selfhosted","sveltekit"],"campaign_type":null,"search_a":"'certain':5A 'crash':2A 'fetch':8A 'ghsa':10A,15A 'ghsa-rqw3-x7hx-mm3p':9A,14A 'mm3p':13A,18A 'proxi':4A 'request':6A 'rqw3':11A,16A 'sveltejs/adapter-node':1A,19A 'via':7A 'x7hx':12A,17A","search_b":"'-248':21B 'add':34B 'attack':50B 'craft':53B 'crash':45B 'cwe':20B 'handl':60B 'header':36B 'host':26B 'immut':39B 'node':22B,47B 'packag':23B,30B 'request':40B,54B,62B 'self':25B 'self-host':24B 'send':52B 'server':48B,58B 'stop':56B 'sveltejs/adapter-node':29B 'sveltekit':27B 'tri':32B 'way':43B","search_c":"'add':70C 'affect':64C 'attempt':68C 'caus':81C 'context':79C 'crash':85C 'deni':86C 'header':72C 'immut':75C 'request':76C,91C 'rout':92C 'server':83C,95C 'servic':87C 'sveltejs/adapter-node':66C 'version':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T23:47:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-rqw3-x7hx-mm3p","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-rqw3-x7hx-mm3p","severity":"medium","published_at":"2026-10-29T23:47:02+00:00","modified_at":"2026-10-29T23:47:02+00:00","first_seen_at":"2026-11-09T22:53:16+00:00","fetched_at":"2026-11-09T22:53:16+00:00","note":null}],"documents":[{"id":110423,"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-rqw3-x7hx-mm3p","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}