AIKIDO-2026-401792

@sveltejs/kit is vulnerable to Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) Pre-CVE Published Jul 20, 2026

Medium Risk

This Affects:

@sveltejs/kit

2.36.3 - 2.69.3

Fixed in 2.70.0

Are you affected? Scan for Free

TL;DR

SvelteKit enforces its built-in cross-site origin and CSRF protection in respond.js only inside a block gated on a development check. Because that check is resolved from NODE_ENV in bundled apps, building a server with any non-production NODE_ENV value compiles the origin and form-submission checks out of the deployed application. As a result, forged cross-site form submissions and cross-origin remote-function requests are processed instead of being rejected with a 403, exposing state-changing endpoints to cross-site request forgery. The fix gates the enforcement on a build-time development constant so the protection stays active in every non-vite dev build regardless of NODE_ENV.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application server is built with a non-production NODE_ENV value (for example NODE_ENV=staging vite build).