6.3
Medium
CVE-2026-40074 SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte
Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| kit 2.57 | earliest → < 2.57.1 | 2.57.1 |
Other CVEs of kit
The 22 CVEs of kit →
CVE-2026-114063
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on…
8.7
High
CVE-2026-114062
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach…
6.9
Medium
CVE-2026-114061
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a…
2.3
Low
CVE-2026-114060
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on…
2.1
Low