SvelteKit 2.70.2

SvelteKit 2.70.2 ships today as a patch release that addresses a security-related content negotiation vulnerability. Maintainers recommend upgrading promptly.

What Changed

The headline fix in 2.70.2 resolves a quadratic backtracking issue in the Accept header content-negotiation logic. Under specific conditions, malformed or malicious Accept headers could trigger excessive server-side processing time, creating a denial-of-service vector.

Why It Matters

While the vulnerability required crafted HTTP requests to exploit, it affected all SvelteKit applications that perform content negotiation — essentially every SSR deployment. The fix prevents the backtracking pattern while maintaining full compatibility with existing Accept-header parsing behavior.

Upgrade Path

Update your @sveltejs/kit dependency in package.json to ^2.70.2 and reinstall:

npm install @sveltejs/kit@latest

No code changes are required. This is a drop-in patch with no breaking changes.

Looking Ahead

This release follows 2.70.0's defineEnvVars refactor and 2.70.1's documentation updates. The SvelteKit team continues to balance feature development with security hardening as the ecosystem prepares for the upcoming SvelteKit 3.0 milestones.