Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-40074: SvelteKit redirect can crash server, causing downtime

CVE-2026-40074 · published 6 months ago

Summary

Websites built with SvelteKit versions before 2.57.1 may crash when a redirect is issued from the server's handle hook with a location that contains characters not allowed in HTTP headers. This can lead to temporary loss of service, especially if the location value comes from user input. Update SvelteKit to version 2.57.1 or later to resolve the issue.

What to do

Update sveltejs kit to version 2.57.1.
Update sveltejs @sveltejs/kit to version 2.57.1.
Update svelte kit to version 2.57.1 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	sveltejs	kit	<= 2.57.0 Fix: upgrade to 2.57.1
npm	sveltejs	@sveltejs/kit	< 2.57.1 Fix: upgrade to 2.57.1
–	svelte	kit	< 2.57.1 `cpe:2.3:a:svelte:kit::::::node.js::*`

Original advisory text

SvelteKit's invalidated redirect in handle hook causes Denial-of-Service

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.

References

https://github.com/sveltejs/kit/commit/10d7b44425c3d9da642eecce373d0c6ef83b4fcd Patch
https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected] Product Release Notes
https://github.com/sveltejs/kit/security/advisories/GHSA-3f6h-2hrp-w5wx Vendor Advisory
https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.57.1
https://github.com/advisories/GHSA-3f6h-2hrp-w5wx
https://github.com/sveltejs/kit Product
https://nvd.nist.gov/vuln/detail/CVE-2026-40074 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40074... Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

6.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-755Improper Handling of Exceptional Conditions

Timeline

Published10 Apr 2026

Updated4 Nov 2026

First seen10 Apr 2026

Sources

CVE-2026-40074 · NVD

GHSA-3f6h-2hrp-w5wx · GHSA

GHSA-3f6h-2hrp-w5wx · OSV

CVE-2026-40074 · OSV

Track software like this

Free during beta