MEDIUM

GHSA-hgv7-v322-mmgr

@sveltejs/kit: `query.batch` cross-talk

Details

`query.batch()` could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / @sveltejs/kit

Introduced in: 2.38.0 Fixed in: 2.60.1

Fix npm install @sveltejs/kit@2.60.1

References

https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr [WEB]
https://github.com/sveltejs/kit/commit/dadaefc2e647a0a62f49f3ee8bc7aa46f5e27056 [WEB]
https://github.com/sveltejs/kit [PACKAGE]