MEDIUM

GHSA-hgv7-v322-mmgr

@sveltejs/kit: `query.batch` cross-talk

Quick fix

GHSA-hgv7-v322-mmgr — @sveltejs/kit: upgrade to the fixed version with the command below.

npm install @sveltejs/kit@2.60.1

Details

`query.batch()` could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@sveltejs/kit

Introduced in: 2.38.0Fixed in: 2.60.1

Fixnpm install @sveltejs/kit@2.60.1

References

https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr[WEB]
https://github.com/sveltejs/kit/commit/dadaefc2e647a0a62f49f3ee8bc7aa46f5e27056[WEB]
https://github.com/sveltejs/kit[PACKAGE]