{"id":"GHSA-hgv7-v322-mmgr","aliases":[],"url":"https://o3.security/vulnerability/GHSA-hgv7-v322-mmgr","summary":"@sveltejs/kit: `query.batch` cross-talk","details":"`query.batch()` could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.","published":"2026-05-21T17:59:05Z","modified":"2026-07-01T17:01:44.457380313Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@sveltejs/kit","fixedVersion":"2.60.1"}],"fix":{"url":"https://github.com/sveltejs/kit/commit/dadaefc2e647a0a62f49f3ee8bc7aa46f5e27056","label":"sveltejs/kit@dadaefc"},"references":[{"type":"WEB","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr"},{"type":"WEB","url":"https://github.com/sveltejs/kit/commit/dadaefc2e647a0a62f49f3ee8bc7aa46f5e27056"},{"type":"PACKAGE","url":"https://github.com/sveltejs/kit"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-01T17:01:44.457380313Z"}}