CVEs affecting the Svelte ecosystem

The Svelte team has released patches for 5 security vulnerabilities across devalue, svelte, @sveltejs/kit, and @sveltejs/adapter-node. The vulnerabilities include two DoS issues in devalue.parse causing memory/CPU exhaustion, a memory amplification DoS in SvelteKit's remote functions deserializer, a DoS and potential SSRF when using prerendering, and an XSS vulnerability via the hydratable feature. Users should upgrade to devalue 5.6.2, svelte 5.46.4, @sveltejs/kit 2.49.5, and @sveltejs/adapter-node 5.5.1. Most vulnerabilities affect applications parsing user-controlled input or using specific experimental features.