Potential Denial of Service in SvelteKit by Svelte
CVE-2026-128117
5.9MEDIUM
What is CVE-2026-128117?
SvelteKit, a framework for developing web applications, has a flaw in its reroute hook prior to versions 2.70.4 and 3.1.1. This vulnerability allows an invalid percent-encoded pathname to be rewritten into a valid route, which can lead to a comparison that decodes the original malformed pathname outside of the intended decoding operation. The resulting unhandled URIError can crash an adapter-node server, leading to service denial for other requests. To mitigate this issue, users are advised to upgrade to the latest versions of SvelteKit.
Affected Version(s)
kit < 2.70.4 < 2.70.4
kit >= 3.0.0, < 3.1.1 < 3.0.0, 3.1.1