chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security] by renovate[bot] · Pull Request #263 · promplate/site

renovate · 2026-02-20T13:42:11Z

This PR contains the following updates:

Package	Change	Age	Confidence
@sveltejs/adapter-vercel (source)	`^5.4.7` → `^6.3.2`

Cache poisoning in @sveltejs/adapter-vercel

CVE-2026-27118 / GHSA-9pq4-5hcf-288c

More information

Details

Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users.

Successful exploitation requires a victim to visit an attacker-controlled link while authenticated.

Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sveltejs/kit (@sveltejs/adapter-vercel)

`v6.3.2`

Compare Source

Patch Changes

fix: 404 for immutable assets that don't match static files (c67da8a)
Updated dependencies [3e607b3, 62991c8, f47c01b]:
- @sveltejs/kit@2.52.2

`v6.3.1`

Compare Source

Patch Changes

feat: show remote function calls under the /_app/remote route in observability (#15098)
fix: prevent isr routes from handling remote function calls (#15098)
Updated dependencies [46c1ebd, 2dd74c8, 8871b54]:
- @sveltejs/kit@2.50.1

`v6.3.0`

Compare Source

Minor Changes

chore: mark RequestContext as deprecated and refer to @vercel/functions (#14725)

Patch Changes

Updated dependencies [e67613c, a5c313e, 06de550]:
- @sveltejs/kit@2.49.3

`v6.2.0`

Compare Source

Minor Changes

feat: Node 24 support (#14982)

`v6.1.2`

Compare Source

Patch Changes

chore(deps): upgrade to @vercel/nft version 1.0.0 to reduce dependencies (#14950)
Updated dependencies [0889a2a, 2ff3951, 5b30755]:
- @sveltejs/kit@2.48.7

`v6.1.1`

Compare Source

Patch Changes

chore: improve runtime config parsing (#14838)
Updated dependencies [cd72d94, 53b1b73, 2ccc638]:
- @sveltejs/kit@2.48.3

`v6.1.0`

Compare Source

Minor Changes

feat: Add experimental support for Bun runtime (#14817)

Patch Changes

Updated dependencies [102aecf]:
- @sveltejs/kit@2.48.1

`v6.0.0`

Compare Source

Major Changes

breaking: remove Node polyfills (and by extension support for Node 18) (#14732)

Minor Changes

feat: parse isr.expiration, allowing it to be a string (#14691)

Patch Changes

Updated dependencies [9c933a2, dedda71]:
- @sveltejs/kit@2.47.0

`v5.10.3`

Compare Source

Patch Changes

chore: update "homepage" field in package.json (#14579)

`v5.10.2`

Compare Source

Patch Changes

fix: ensure read works in an edge function that has deployment protection. Protection bypass automation must be enabled (#14147)
Updated dependencies [c8f7ac3, 107f767]:
- @sveltejs/kit@2.33.1

`v5.10.1`

Compare Source

Patch Changes

chore: deprecate runtime config (#14253)

`v5.10.0`

Compare Source

Minor Changes

feat: use web standard fetch export (#14251)

Patch Changes

Updated dependencies [1d04a77, 5db4cd4]:
- @sveltejs/kit@2.32.0

`v5.9.1`

Compare Source

Patch Changes

fix: avoid erroring on builder properties that only exist on the latest version of SvelteKit (#14233)
Updated dependencies [f2db41c]:
- @sveltejs/kit@2.31.1

`v5.9.0`

Compare Source

Minor Changes

feat: add instrumentation.server.ts for tracing and observability setup (#13899)

Patch Changes

Updated dependencies [f635678, f635678]:
- @sveltejs/kit@2.31.0

`v5.8.2`

Compare Source

Patch Changes

chore: add .git to the end of package.json repository url (#14134)
Updated dependencies [c968aef]:
- @sveltejs/kit@2.27.3

`v5.8.1`

Compare Source

Patch Changes

chore(deps): update dependency @vercel/nft to ^0.30.0 (#14033)

`v5.8.0`

Compare Source

Minor Changes

feat: add support for read imported from $app/server in edge functions (#13859)

Patch Changes

Updated dependencies [e5ce8bb, cf88369]:
- @sveltejs/kit@2.25.0

`v5.7.2`

Compare Source

Patch Changes

chore(deps): upgrade to esbuild 0.25.4 (#13770)

`v5.7.1`

Compare Source

Patch Changes

chore(deps): upgrade esbuild to 0.25.2 (#13716)
fix: include the edge-light bundling condition when building edge functions (#13720)
Updated dependencies [c51fb554416e0c4a21655c1d79e834f69743d1d5]:
- @sveltejs/kit@2.20.8

`v5.7.0`

Compare Source

Minor Changes

feat: create symlink functions for each route, for better observability (#13679)

Patch Changes

Updated dependencies [7fd7bcb7142e7d0d2dd64174fa1a94d56a45d643]:
- @sveltejs/kit@2.20.4

`v5.6.3`

Compare Source

Patch Changes

chore(deps): upgrade @vercel/nft to fix glob deprecation warnings (b1e9781a6dff41841d8e1509311d948421956746)

Patch Changes

fix: correct edge function path for route resolution endpoint (#13409)

`v5.6.0`

Compare Source

Minor Changes

feat: generate edge function dedicated to server side route resolution when using that option in SvelteKit (#13379)

Patch Changes

Updated dependencies [09296d0f19c8d1ff57d699e637bd1beabb69d438, d62ed39a431f0db3db4dd90bf6b17ed2a2a2de79, f30352f874790b9de0bd0eba985a21aef23e158e, 180fa3467e195065c0a25206c6328a908e6952d7, 5906e9708965b848b468d0014999c36272dc8d50, d62ed39a431f0db3db4dd90bf6b17ed2a2a2de79]:
- @sveltejs/kit@2.17.0

`v5.5.3`

Compare Source

Patch Changes

`v5.5.2`

Compare Source

Patch Changes

chore: upgrade @vercel/nft to 0.27.9 (#13129)
Updated dependencies [9fc5ff3339e543b956f7ce5eb31267fa73ee332a, 85b57168189fa16fe966434ec50cc19425cab275]:
- @sveltejs/kit@2.10.0

`v5.5.1`

Compare Source

Patch Changes

chore: upgrade @vercel/nft to 0.27.7 (#13082)
Updated dependencies [78404dfe1eb346723eefc183278b85f25485b419]:
- @sveltejs/kit@2.9.1

`v5.5.0`

Compare Source

Minor Changes

chore: upgrade esbuild to 0.24.0 (#12270)

Patch Changes

Updated dependencies [d030f4bb285e70844d09b3f0c87809bae43014b8, 67dd214863cbc5852eb0e8512efbb7bad5358e8a]:
- @sveltejs/kit@2.9.0

`v5.4.8`

Compare Source

Patch Changes

chore: support building with Node 22 (#13043)
Updated dependencies [570562b74d9e9f295d9b617478088a650f51e96b, 1358cccd52190df3c74bdd8970dbfb06ffc4ec72]:
- @sveltejs/kit@2.8.2

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-02-20T13:42:13Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
promplate-docs	Ready	Preview, Comment	May 29, 2026 3:10am

bolt-new-by-stackblitz · 2026-02-20T13:42:16Z

Run & review this pull request in StackBlitz Codeflow.

vercel Bot deployed to Preview February 20, 2026 13:43 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 9178d33 to 90728ff Compare March 5, 2026 09:11

vercel Bot deployed to Preview March 5, 2026 09:13 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 90728ff to 87f7aa0 Compare March 5, 2026 19:58

vercel Bot deployed to Preview March 5, 2026 19:59 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 87f7aa0 to 04a4784 Compare March 13, 2026 11:05

vercel Bot deployed to Preview March 13, 2026 11:06 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 04a4784 to f3f4d89 Compare March 13, 2026 19:04

vercel Bot deployed to Preview March 13, 2026 19:06 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch 4 times, most recently from 342d76a to 6491cc8 Compare March 15, 2026 01:45

vercel Bot deployed to Preview March 15, 2026 01:46 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch 3 times, most recently from b53dcaa to ae6e5b1 Compare March 15, 2026 02:27

vercel Bot deployed to Preview March 15, 2026 02:36 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from ae6e5b1 to 8adc4fc Compare March 15, 2026 04:01

vercel Bot deployed to Preview March 15, 2026 04:03 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch 2 times, most recently from cb2818d to 805cc0c Compare March 15, 2026 16:07

vercel Bot deployed to Preview March 15, 2026 16:14 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 805cc0c to faa7089 Compare March 26, 2026 17:54

vercel Bot deployed to Preview March 26, 2026 17:56 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from faa7089 to dfaa9fa Compare March 26, 2026 22:06

vercel Bot deployed to Preview March 26, 2026 22:07 View deployment

renovate Bot changed the title ~~chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security]~~ chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security] - autoclosed Mar 27, 2026

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 0d18314 to 4bb3fcf Compare April 7, 2026 01:21

vercel Bot deployed to Preview April 7, 2026 01:23 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 4bb3fcf to 023c8d0 Compare April 8, 2026 16:52

vercel Bot deployed to Preview April 8, 2026 16:54 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 023c8d0 to 9af41b2 Compare April 8, 2026 22:56

vercel Bot deployed to Preview April 8, 2026 22:58 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 9af41b2 to 3d762b1 Compare April 15, 2026 09:47

vercel Bot deployed to Preview April 15, 2026 09:48 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 3d762b1 to b7d9b04 Compare April 16, 2026 23:17

vercel Bot deployed to Preview April 16, 2026 23:19 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from b7d9b04 to 90358f5 Compare April 19, 2026 10:17

vercel Bot deployed to Preview April 19, 2026 10:19 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 90358f5 to aed7e4c Compare April 19, 2026 17:59

vercel Bot deployed to Preview April 19, 2026 18:01 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from aed7e4c to 6550b7b Compare April 21, 2026 20:54

vercel Bot deployed to Preview April 21, 2026 20:56 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 6550b7b to 7841d1c Compare April 22, 2026 03:07

vercel Bot deployed to Preview April 22, 2026 03:09 View deployment

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 7841d1c to 49da8ae Compare April 23, 2026 16:43

vercel Bot had a problem deploying to Preview April 23, 2026 16:44 Failure

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch from 49da8ae to 74ff033 Compare April 23, 2026 22:12

vercel Bot deployed to Preview April 23, 2026 22:13 View deployment

renovate Bot changed the title ~~chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security]~~ chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

renovate Bot changed the title ~~chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security] - autoclosed~~ chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security] Apr 27, 2026

renovate Bot reopened this Apr 27, 2026

renovate Bot force-pushed the renovate/npm-sveltejs-adapter-vercel-vulnerability branch 2 times, most recently from 74ff033 to 7cb812e Compare April 27, 2026 22:12

vercel Bot deployed to Preview April 27, 2026 22:14 View deployment

chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security]

caf3980

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security]#263

chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security]#263
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-sveltejs-adapter-vercel-vulnerability

renovate Bot commented Feb 20, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Feb 20, 2026 •

edited

Loading

Uh oh!

bolt-new-by-stackblitz Bot commented Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Cache poisoning in @​sveltejs/adapter-vercel

Details

Severity

References

Release Notes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Major Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

vercel Bot commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bolt-new-by-stackblitz Bot commented Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Feb 20, 2026 •

edited

Loading

Cache poisoning in @sveltejs/adapter-vercel

vercel Bot commented Feb 20, 2026 •

edited

Loading