PT-2026-31990 · Sveltekit · Sveltekit

CVE-2026-40074 · Published 2026-04-10 · Updated 2026-04-28

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SvelteKit versions prior to 2.57.1

Description SvelteKit, a framework for developing web applications, is susceptible to a denial-of-service (DoS) condition. When the redirect function is invoked within the handle server hook with a location parameter containing characters invalid for an HTTP header, an unhandled TypeError occurs. This is particularly problematic when the location parameter passed to redirect includes unsanitized user input, potentially leading to DoS on certain platforms.

Recommendations Update to SvelteKit version 2.57.1 or later.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2026-40074

GHSA-3F6H-2HRP-W5WX

Affected Products

Sveltekit

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40074.json · Exploit
• https://github.com/sveltejs/kit/security/advisories/GHSA-3f6h-2hrp-w5wx · Vendor Advisory
• https://github.com/sveltejs/kit/commit/10d7b44425c3d9da642eecce373d0c6ef83b4fcd · Patch
• https://osv.dev/vulnerability/CVE-2026-40074 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3f6h-2hrp-w5wx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40074 · Security Note
• https://github.com/sveltejs/kit · Note
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1 · Note
• https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.57.1 · Note
• https://twitter.com/_cvereports/status/2049068833663508499 · Twitter Post
• https://twitter.com/CVEnew/status/2042710230111330333 · Twitter Post