PT-2026-31990 · Sveltekit · Sveltekit

Published 2026-04-10 · Updated 2026-04-28 · CVE-2026-40074

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SvelteKit versions prior to 2.57.1

Description SvelteKit, a framework for developing web applications, is susceptible to a denial-of-service (DoS) condition. When the redirect function is invoked within the handle server hook with a location parameter containing characters invalid for an HTTP header, an unhandled TypeError occurs. This is particularly problematic when the location parameter passed to redirect includes unsanitized user input, potentially leading to DoS on certain platforms.

Recommendations Update to SvelteKit version 2.57.1 or later.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2026-40074

GHSA-3F6H-2HRP-W5WX

Affected Products

Sveltekit

References · 9

• https://github.com/sveltejs/kit/security/advisories/GHSA-3f6h-2hrp-w5wx · Vendor Advisory
• https://github.com/sveltejs/kit/commit/10d7b44425c3d9da642eecce373d0c6ef83b4fcd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40074 · Security Note
• https://osv.dev/vulnerability/GHSA-3f6h-2hrp-w5wx · Vendor Advisory
• https://github.com/sveltejs/kit · Note
• https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.57.1 · Note
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1 · Note
• https://twitter.com/_cvereports/status/2049068833663508499 · Twitter Post
• https://twitter.com/CVEnew/status/2042710230111330333 · Twitter Post