CVE-2025-67647
📋 TL;DR
SvelteKit versions 2.19.0 through 2.49.4 are vulnerable to server-side request forgery (SSRF) and denial of service (DoS) attacks. The vulnerability affects applications with prerendered routes, particularly when using adapter-node without proper ORIGIN configuration. Attackers can exploit this to make unauthorized requests from the server or crash the application.
💻 Affected Systems
- SvelteKit
📦 What is this software?
Kit by Svelte
⚠️ Risk & Real-World Impact
Worst Case
Full SSRF allowing internal network reconnaissance, data exfiltration, or lateral movement combined with application downtime from DoS.
Likely Case
Application denial of service causing service disruption for users, potentially with limited SSRF capabilities.
If Mitigated
Minimal impact if proper reverse proxy Host header validation and ORIGIN environment variables are configured.
🎯 Exploit Status
The advisory suggests exploitation is straightforward for DoS, with SSRF requiring specific conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.49.5
Vendor Advisory: https://github.com/sveltejs/kit/security/advisories/GHSA-j62c-4x62-9r35
Restart Required: Yes
Instructions:
1. Update package.json to specify "@sveltejs/kit": "^2.49.5". 2. Run npm update @sveltejs/kit or yarn upgrade @sveltejs/kit. 3. Restart your application server.
🔧 Temporary Workarounds
Configure ORIGIN environment variable
allSet ORIGIN environment variable when using adapter-node to prevent exploitation
export ORIGIN=https://your-domain.com
Implement reverse proxy with Host validation
allDeploy a reverse proxy (nginx, Apache) that validates Host headers
🧯 If You Can't Patch
- Disable prerendering for all routes by removing export const prerender = true
- Implement strict network egress controls to limit SSRF impact
🔍 How to Verify
Check if Vulnerable:
Check package.json for @sveltejs/kit version between 2.19.0 and 2.49.4 and verify if any routes have export const prerender = trueCheck Version:
npm list @sveltejs/kit | grep @sveltejs/kitVerify Fix Applied:
Confirm @sveltejs/kit version is 2.49.5 or higher in package.json and node_modules📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to internal endpoints
- Application crashes or restarts
- High error rates for prerendered routes
Network Indicators:
- Unexpected outbound requests from application server
- Traffic patterns suggesting SSRF attempts
SIEM Query:
source="application.logs" AND ("prerender" OR "SSRF" OR "Host header") AND severity=ERROR