Vulnerability · Published Apr 10, 2026 · Assigned by GitHub_M
CVE-2026-40074SvelteKit's invalidated redirect in handle hook causes Denial-of-Service
Medium 6.3
In plain English
A medium-severity security flaw in kit from sveltejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @sveltejs/kit | 2.57.1 | GHSA-3f6h-2hrp-w5wx |
Affected products (as reported)
Weakness: CWE-755 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
References
- https://github.com/sveltejs/kit/security/advisories/GHSA-3f6h-2hrp-w5wx x_refsource_CONFIRM
- https://github.com/sveltejs/kit/commit/10d7b44425c3d9da642eecce373d0c6ef83b4fcd x_refsource_MISC
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1 x_refsource_MISC