AIKIDO-2026-10191
@sveltejs/adapter-vercel is vulnerable to Acceptance of Extraneous Untrusted Data With Trusted Data
75
High Risk
This Affects:
@sveltejs/adapter-vercelTL;DR
Affected versions of this package are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is exposed on all routes and can be manipulated by attackers to alter caching behavior, allowing user-specific or sensitive responses to be cached and subsequently served to other users. Successful exploitation requires an authenticated victim to visit an attacker-controlled link.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@sveltejs/adapter-vercel is vulnerable to Acceptance of Extraneous Untrusted Data With Trusted Data in versions 0.0.1 - 6.3.1.
How to fix this
Upgrade the @sveltejs/adapter-vercel library to a patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant