Cache Deception Vulnerability Found in SvelteKit and Vercel Combo Exposes User Data to Attackers

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cache Deception Vulnerability in SvelteKit and Vercel Exposes User Data A cache deception vulnerability was discovered in applications built with SvelteKit and deployed on Vercel, allowing attackers to read responses from other signed-in users. The issue was reported by an AI agent during testing and was confirmed reproducible. Vercel issued a fix for the vulnerability on February 19, 2026. 4 sources 45