Cyber Resilience

CVE-2025-67647

SSRF in Svelte Adapter-Node 5.4.1 – 5.5.1

Published
15 January 2026
Modified
21 January 2026
Patch / advisory
CVSS Score v4 8.4
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0047 38th percentile
Risk Priority 44 floored blend · peak EPSS

Summary

CVE-2025-67647 is a high-severity Uncaught Exception (CWE-248) vulnerability in Svelte Adapter-Node. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-67647 is a server-side request forgery (SSRF) and denial-of-service (DoS) vulnerability affecting SvelteKit, a framework for building robust, performant web applications using Svelte. The issue impacts versions prior to 2.49.5, with specific DoS triggers in certain configurations: from 2.44.0 through 2.49.4 when an application has at least one prerendered route (export const prerender = true); and from 2.19.0 through 2.49.4 when using adapter-node without a configured ORIGIN environment variable and lacking a reverse proxy that validates the Host header. It is associated with CWE-248 and CWE-918, carrying a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity. Successful exploitation results in SSRF, enabling high confidentiality impact through unauthorized access to internal resources, and DoS, causing high availability impact by disrupting service, particularly in applications meeting the prerendered route and adapter-node conditions.

The vulnerability is fixed in SvelteKit version 2.49.5. Official mitigation guidance is available in the SvelteKit security advisory at https://github.com/sveltejs/kit/security/advisories/GHSA-j62c-4x62-9r35, with the patching commit at https://github.com/sveltejs/kit/commit/d9ae9b00b14f5574d109f3fd548f960594346226. Security practitioners should upgrade to 2.49.5 or later and review configurations for prerendered routes and adapter-node usage.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability…

more

results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. This vulnerability is fixed in 2.49.5.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-23641Same product: Svelte Adapter-Node
CVE-2026-40074Same product: Svelte Kit
CVE-2026-22803Same product: Svelte Kit
CVE-2026-40073Same product: Svelte Kit
CVE-2023-29008Same vendor: Svelte
CVE-2023-29003Same vendor: Svelte
CVE-2026-42567Same vendor: Svelte
CVE-2026-30226Same vendor: Svelte
CVE-2026-42573Same vendor: Svelte
CVE-2026-27119Same vendor: Svelte

Affected Assets

svelte
adapter-node
5.4.1 — 5.5.1
svelte
kit
2.19.0 — 2.49.5

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.3.6
  • V1.5.3
  • V5.3.2
  • V10.4.7

Mitigating Controls (NIST 800-53 r5) AI

Information flow enforcement can restrict which destinations the server is allowed to contact on behalf of users.

Input validation directly stops untrusted URLs from being accepted and fetched without destination checks.

Security engineering principles include robust exception management to keep the system in a defined state.

Fail-in-known-state reduces the impact when an uncaught exception occurs by preserving a safe condition.

Boundary protection limits the network reach of server-initiated requests even if SSRF occurs.

Error handling requirements force structured catching and response to exceptions instead of allowing them to propagate uncaught.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices explicitly require structured exception handling to prevent uncaught exceptions from reaching production.

DE.CM-09 partial match
prevents

Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover and record SSRF flaws in web applications.

PR.IR-01 partial match
prevents

Network segmentation and egress controls can limit the damage from successful SSRF requests.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect uncaught exceptions before production deployment.

prevents

Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.

prevents

Secure development lifecycle includes exception-handling standards that reduce uncaught exceptions.

prevents

Application security requirements typically mandate robust error and exception handling.

prevents

Secure architecture principles call for centralized, comprehensive exception management.

prevents

Secure coding standards directly require catching and handling exceptions to prevent crashes or leaks.

References