CVE-2026-82258 — SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch
SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context…
Published: 2026-08-28 · CVSS: 5.9 · CVSS 4.0
SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7