What is GHSA-hgv7-v322-mmgr?

GHSA-hgv7-v322-mmgr is a security advisory published by GitHub Security Advisories with Medium severity. @sveltejs/kit: `query.batch` cross-talk

Why does GHSA-hgv7-v322-mmgr have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-hgv7-v322-mmgr?

GHSA-hgv7-v322-mmgr affects 1 product, including: npm/@sveltejs/kit:\u003e= 2.38.0, \u003c= 2.60.0.

GHSA-hgv7-v322-mmgrMediumDisclosed before NVD

@sveltejs/kit: `query.batch` cross-talk

Vendor

GitHub Security Advisories

Published

May 21, 2026

Last Modified

May 21, 2026

📋 Description

`query.batch()` could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.

🎯 Affected products1

npm/@sveltejs/kit:>= 2.38.0, <= 2.60.0

🔗 References (2)

https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr
https://github.com/advisories/GHSA-hgv7-v322-mmgr