SvelteKit 2.70.4 patches a cross-origin code load and a path traversal bug
Five fixes in one patch release: a server-side route resolver that could load code from another origin, a Windows path traversal in prerendered page previews, and more.
The SvelteKit team shipped version 2.70.4 on 5 November, a patch release carrying five security and stability fixes. The two most serious: server-side route resolution could load code from another origin when a pathname started with //, and previewing prerendered pages and data on Windows was vulnerable to path traversal. The other three fixes close a malformed-pathname crash in reroute, escape cache-control headers in prerendered HTML, and stop server-side self-fetch fallbacks from following redirects. All five are tracked under pull request #17620.
@sveltejs/kit runs close to two million npm downloads a week, so this isn’t a niche fix. None of the issues have a published CVE or confirmed in-the-wild exploitation, but the cross-origin route resolution bug in particular is the kind of thing worth not sitting on.
npm install @sveltejs/kit@latestWhy it matters: if you’re on SvelteKit and deploy through the Vercel, Node, Static or Cloudflare adapters, update now rather than waiting for the next scheduled dependency bump. The route-resolution and path-traversal fixes are server-side behaviour changes, not opt-in flags, so there’s nothing else to configure once you’re on 2.70.4.