SvelteKit 2.38.0 through the 2.60.x series exposes a race condition in the query.batch function. The deficiency allows simultaneous requests from distinct users to be merged into a single request context when specific timing conditions are met. The result is that sensitive data belonging to one user can be accessed by another user during the rendering process. This vulnerability represents a data confidentiality issue because the race can expose unencrypted request payloads, session information, or other sensitive data that is not meant for the requesting party. The weakness is identified as CWE‑362, a classic concurrency error that can be exploited for information disclosure.

Vendors affected are the SvelteKit framework maintained by the sveltejs organization. The flaw exists in versions starting at 2.38.0 up to, but not including, 2.60.1. Any deployment of SvelteKit between these releases -- regardless of the runtime platform -- is potentially vulnerable if query.batch is exercised in a concurrent manner by multiple authenticated or unauthenticated users.

The CVSS score of 5.9 denotes a medium severity overall. The EPSS score is not listed, indicating no publicly documented probability of exploitation. The vulnerability is not currently in the CISA KEV catalog. Exploitation requires precise orchestration of concurrent requests, implying that the attack vector is likely internal to the application or the hosting environment where multiple users interact with the same SvelteKit instance. An attacker may leverage timing and load to trigger the race and read data from a teammate’s request context. The lack of an immediate public exploit and the medium CVSS suggest that while the vulnerability is serious, it is not an imminent threat to all installations. Ongoing monitoring and immediate patching are recommended.