Cache Deception Flaw in SvelteKit And Vercel Stack Exposes User Data

Why It Matters

The issue exposes authenticated user data to unauthenticated parties, undermining privacy guarantees for countless SvelteKit sites hosted on Vercel and highlighting the risks of unchecked cache configurations.

Key Takeaways

• Vercel caches SvelteKit immutable paths publicly without validation.
• __pathname parameter rewrites request to private API endpoints.
• Attackers retrieve cached private data via cookie‑less requests.
• Patch in adapter‑vercel 6.3.2 blocks invalid immutable paths.
• Upgrade and add Cache‑Control: private to protect sensitive routes.

Pulse Analysis

Cache deception attacks exploit mismatches between how browsers interpret URLs and how edge caches store responses. In modern JAMstack deployments, frameworks like SvelteKit rely on platform‑provided adapters to map dynamic routes onto static‑friendly paths. Vercel’s aggressive caching of the `/_app/immutable/` directory assumes content is immutable and safe for public reuse, a premise that the `__pathname` override shattered. By allowing arbitrary path rewrites, the adapter unintentionally turned authenticated API calls into cacheable assets, exposing session data to anyone who knows the crafted URL.

The exploitation chain is straightforward: an attacker crafts a link that appends `?__pathname=/api/session` to a static‑looking path, lures a logged‑in user to click, and the server responds with the user’s session information while Vercel’s edge cache stores the response under the static URL. Subsequent requests without authentication hit the cached entry, revealing tokens, cookies, or personal data. Because the cache key does not incorporate authentication headers, the breach requires only a single user interaction. The flaw’s CVSS score of 5.3 reflects its moderate severity, but the potential scale—affecting any SvelteKit site on Vercel that uses cookie‑based auth—makes it a systemic risk.

Mitigation centers on tightening both framework and platform controls. Vercel’s patch now returns 404 for malformed `/_app/immutable/` requests and strips the `__pathname` parameter, while SvelteKit developers should upgrade to `@sveltejs/adapter-vercel` 6.3.2+ and audit caching headers on sensitive endpoints. Adding `Cache-Control: private` or `no‑store` to authenticated routes prevents accidental public caching. The incident serves as a cautionary tale for developers leveraging serverless adapters: validation of query parameters and explicit cache directives are essential to preserve data confidentiality in edge‑first architectures.