CVE-2025-67647: SSRF in @sveltejs/kit

An attacker can exploit this SSRF vulnerability to make arbitrary requests from the server, potentially accessing internal resources or interacting with external services on behalf of the application. This could lead to data exfiltration, unauthorized access to sensitive systems, or even remote code execution if the targeted internal services are vulnerable. The DoS component allows an attacker to exhaust server resources by triggering excessive requests, leading to application unavailability. The lack of an ORIGIN environment variable in adapter-node configurations significantly increases the risk, as it allows the server to make requests to any domain without restriction. This vulnerability shares similarities with other SSRF exploits where attackers leverage server-side processes to bypass security controls and access restricted resources.

1. Reserved2025-12-09
2. Published2026-01-15
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-67647 is to upgrade to @sveltejs/kit version 2.49.5 or later. If upgrading is not immediately feasible, configure the ORIGIN environment variable for adapter-node to restrict the domains the server can make requests to. Alternatively, implement a reverse proxy that enforces HSTS (HTTP Strict Transport Security) to prevent man-in-the-middle attacks and further limit the scope of potential SSRF exploitation. Review your application's prerendering configuration and ensure that only trusted routes are prerendered. After upgrading, confirm the fix by attempting to trigger a request to an internal or external resource that was previously accessible and verifying that the request is now blocked or redirected.