8.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67647

CVE-2025-67647: SvelteKit Denial of service and possible SSRF when using prerendering

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. This vulnerability is fixed in 2.49.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67647

CVE-2025-67647:

8.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@sveltejs/kit	npm	>= 2.19.0, <= 2.49.4	2.49.5
@sveltejs/adapter-node	npm	>= 5.4.1, <= 5.5.0	5.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit reveals two primary vulnerabilities in SvelteKit. The first is a Server-Side Request Forgery (SSRF) in the @sveltejs/adapter-node package, and the second is a Denial of Service (DoS) in the @sveltejs/kit package, which can also be used to facilitate the SSRF.

The SSRF vulnerability existed in the get_origin function within packages/adapter-node/src/handler.js. This function was responsible for determining the origin of a request, but it did so by unsafely trusting HTTP headers such as x-forwarded-proto and x-forwarded-host. An attacker could manipulate these headers to force the server to construct a URL pointing to an internal service. When SvelteKit subsequently used this URL to fetch resources, it would result in an SSRF attack.

The DoS vulnerability was located in the internal_respond function within packages/kit/src/runtime/server/respond.js. This function had flawed logic for handling prerendered pages. A specially crafted URL could trick the server into treating an external URL as a local, prerendered resource. The server would then attempt to fetch this URL. If the fetch failed (for example, if the URL pointed to a closed port or a slow server), the resulting unhandled promise rejection would crash the entire server process, leading to a denial of service. This mechanism could also be used to trigger the SSRF by forcing a fetch to a URL constructed via the get_origin vulnerability.

The patch addresses these issues by:

Adding robust validation in the get_origin function to ensure that the protocol, host, and port headers contain valid and expected values.
Correcting the path comparison logic in internal_respond to properly handle URL-encoded characters.
Wrapping the fetch call in internal_respond within a try...catch block to gracefully handle errors and prevent the server from crashing.

Vulnerable functions

get_origin

packages/adapter-node/src/handler.js

The `get_origin` function in `packages/adapter-node/src/handler.js` was vulnerable to Server-Side Request Forgery (SSRF). It constructed the origin URL by trusting HTTP headers like `x-forwarded-proto` and `x-forwarded-host` without sufficient validation. An attacker could provide malicious values in these headers to make the SvelteKit server issue requests to internal services or arbitrary external URLs. The patch adds strict validation for the protocol, host, and port values from the headers.

internal_respond

packages/kit/src/runtime/server/respond.js

The `internal_respond` function in `packages/kit/src/runtime/server/respond.js` was vulnerable to Denial of Service (DoS) and could contribute to SSRF. When handling a request for a prerendered route, a flaw in the path comparison logic could be exploited. An attacker could craft a URL that would cause the server to attempt to `fetch` a resource from a malicious URL. If this `fetch` operation failed, it would throw an unhandled exception, crashing the Node.js process and causing a DoS. The patch corrects the path comparison by decoding the URL pathname and wraps the `fetch` call in a `try...catch` block to prevent the server from crashing.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.