Read the docs
TI-2026-28905 Aliases CVE-2026-40074GHSA-3f6h-2hrp-w5wx

SvelteKit's invalidated redirect in handle hook causes Denial-of-Service

Priority LOW 34CWE-755Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00372 31st percentileScored 2026-11-07
Fix Fixed kit (sveltejs): 2.57.1@sveltejs/kit (npm): 2.57.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sveltejskitbefore 2.57.12.57.1Patch availableCNA
—@sveltejs/kit (npm)before 2.57.12.57.1Patch availableGHSA-3f6h-2hrp-w5wx
  • kit Vendorsveltejs Affected before 2.57.1 Fixed in 2.57.1 Patch available CNA
  • @sveltejs/kit (npm) Vendor— Affected before 2.57.1 Fixed in 2.57.1 Patch available GHSA-3f6h-2hrp-w5wx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:svelte:kit:*:*:*:*:*:node.js:*:*before 2.57.1Vulnerablesveltejs
  • cpe:2.3:a:svelte:kit:*:*:*:*:*:node.js:*:* Versions before 2.57.1 Vulnerable ·sveltejs

Remediation

  • Fix · CNA kit (sveltejs) Fixed in 2.57.1
  • Fix · GHSA-3f6h-2hrp-w5wx @sveltejs/kit (npm) Fixed in 2.57.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40074
  2. 2026-10-03 Alias added: GHSA-3f6h-2hrp-w5wx

References

Patch 1

Advisory 2

Other 3

  • TI-2024-15660 Sending a GET or HEAD request with a body crashes SvelteKit CVSS 3.1HIGH 7.5
  • TI-2025-41390 SvelteKit Denial of service and possible SSRF when using prerendering CVSS 4.0HIGH 8.4
  • TI-2026-18320 SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer CVSS 4.0HIGH 8.2
  • TI-2026-28904 SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences