Vulnerability Details CVE-2026-82258
SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 4.3%
CVSS Severity
CVSS v3 Score 4.8
References