SvelteKit ist anfällig für Denial of Service und mögliche SSRF bei Verwendung von Prerendering

An attacker can exploit this SSRF vulnerability to make arbitrary requests from the server, potentially accessing internal resources or interacting with external services on behalf of the application. This could lead to data exfiltration, unauthorized access to sensitive systems, or even remote code execution if the targeted internal services are vulnerable. The DoS component allows an attacker to exhaust server resources by triggering excessive requests, leading to application unavailability. The lack of an ORIGIN environment variable in adapter-node configurations significantly increases the risk, as it allows the server to make requests to any domain without restriction. This vulnerability shares similarities with other SSRF exploits where attackers leverage server-side processes to bypass security controls and access restricted resources.

Applications built with @sveltejs/kit that utilize prerendered routes and the adapter-node are at risk, particularly those lacking a configured ORIGIN environment variable or a reverse proxy with HSTS. Shared hosting environments where users have limited control over server configuration are also particularly vulnerable.

• nodejs / server:

ps aux | grep sveltekit

• nodejs / server:

find / -name 'svelte.config.js' -print

• nodejs / server:

grep -r 'export const prerender = true' . 

• nodejs / server: Check environment variables for ORIGIN in your deployment environment. Use env | grep ORIGIN.

1. 2026-01-15Disclosure

   disclosure

1. Reserviert2025-12-09
2. Veröffentlicht2026-01-15
3. Geändert2026-02-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-67647 is to upgrade to @sveltejs/kit version 2.49.5 or later. If upgrading is not immediately feasible, configure the ORIGIN environment variable for adapter-node to restrict the domains the server can make requests to. Alternatively, implement a reverse proxy that enforces HSTS (HTTP Strict Transport Security) to prevent man-in-the-middle attacks and further limit the scope of potential SSRF exploitation. Review your application's prerendering configuration and ensure that only trusted routes are prerendered. After upgrading, confirm the fix by attempting to trigger a request to an internal or external resource that was previously accessible and verifying that the request is now blocked or redirected.