CVE-2026-27118: Cache Poisoning in @sveltejs/adapter-vercel
Summary
CVE-2026-27118: Cache poisoning in @sveltejs/adapter-vercel. Affects @sveltejs/adapter-vercel versions < 6.3.2. Fixed in 6.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @sveltejs/adapter-vercel package is a crucial component for deploying Svelte applications on the Vercel platform. It facilitates the integration of Svelte apps with Vercel's serverless architecture, allowing developers to leverage features like Incremental Static Regeneration (ISR). However, a vulnerability has been identified that could compromise the integrity of cached responses, potentially exposing sensitive user data.
Vulnerability Detail
Versions of @sveltejs/adapter-vercel prior to 6.3.2 are susceptible to cache poisoning. This vulnerability arises from an internal query parameter meant for Incremental Static Regeneration (ISR) being accessible across all routes. An attacker can exploit this flaw by crafting a malicious link that, when visited by an authenticated user, causes sensitive user-specific responses to be cached and subsequently served to other users. The implications of this vulnerability are serious, as it can lead to unauthorized access to sensitive information.
How To Fix
Minimum fixed version
6.3.2
This is the first release that contains the fix.
npm install @sveltejs/adapter-vercel@6.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While the best course of action is to upgrade to the patched version, users can mitigate risks by ensuring that sensitive data is not exposed through public routes and by implementing strict access controls on user-specific information.
Conclusion
The vulnerability identified in @sveltejs/adapter-vercel poses a significant risk of cache poisoning, which can lead to unauthorized access to sensitive user information. Users are strongly encouraged to upgrade to version 6.3.2 or later to safeguard their applications. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for @sveltejs/adapter-vercel →
FAQ
Cache poisoning is a type of attack where an attacker manipulates the cache of a server to serve malicious or incorrect content to users.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
If exploited, this vulnerability can lead to sensitive user data being cached and served to unauthorized users, potentially compromising user privacy and security.
While Vercel's Web Application Firewall (WAF) provides some protection, it is still crucial to upgrade to the patched version to fully mitigate the risk.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of risk.
