Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, GHSA-hgv7-v322-mmgr, is a cross-talk issue in @sveltejs/kit's query.batch() function. An analysis of the patch that fixes this vulnerability reveals that the root cause was a shared state between different requests. The function batch in packages/kit/src/runtime/app/server/remote/query.js used a module-scoped Map named batching to queue and process batched queries. In a concurrent environment like a Node.js server, this map could be accessed by multiple requests simultaneously. This created a race condition where data from one user's request could be incorrectly associated with another user's request, leading to data disclosure. The fix involves moving the batching mechanism to be part of the request-specific state, which is obtained via get_request_store(). This ensures that each request has its own isolated batching context, eliminating the possibility of cross-request data leakage. The primary vulnerable function is batch, as it contained the flawed logic of using a shared state for batch processing.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @sveltejs/kit | npm | >= 2.38.0, <= 2.60.0 | 2.60.1 |
