CVE-2026-40074

The record

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.

Affected packages

Related vulnerabilities

• GHSA-3f6h-2hrp-w5wx @sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service Same vulnerability
• GHSA-hgv7-v322-mmgr @sveltejs/kit: `query.batch` cross-talk Also affects @sveltejs/kit
• GHSA-2crg-3p73-43xp @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass Also affects @sveltejs/kit
• CVE-2026-40073 SvelteKit is a framework for rapidly developing robust, performant web applications using… Also affects @sveltejs/kit
• GHSA-fpg4-jhqr-589c SvelteKit has deserialization expansion in unvalidated `form` remote function leading to… Also affects @sveltejs/kit
• GHSA-88qp-p4qg-rqm6 CPU exhaustion in SvelteKit remote form deserialization (experimental only) Also affects @sveltejs/kit
• GHSA-vrhm-gvg7-fpcf Memory exhaustion in SvelteKit remote form deserialization (experimental only) Also affects @sveltejs/kit
• GHSA-j2f3-wq62-6q46 @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form… Also affects @sveltejs/kit