The vulnerability originates from a regular expression used by SvelteKit to parse content‑negotiation headers such as Accept. A maliciously crafted Accept header can trigger quadratic backtracking in the regex engine, leading to excessive CPU consumption and a denial of service. The weakness is a ReDoS (CWE‑1333) that affects the availability of the application by exhausting server resources.

SvelteKit, the web application framework maintained by sveltejs, is vulnerable in all releases prior to 2.70.2. The fix is included in 2.70.2, so any deployment running an older version is at risk.

The CVSS base score of 5.3 indicates a moderate impact, and no EPSS information is available. The vulnerability does not require authentication and can be triggered by placing a specially crafted Accept header in any HTTP request, so an attacker can easily perform a DoS attack against the subscribed service. The vulnerability is not listed in CISA’s KEV catalog, but given the ease of exploitation and resource exhaustion, it remains a relevant threat for exposed web applications.