Denial of Service Vulnerability in SvelteKit Framework by Svelte
CVE-2026-128123
5.9MEDIUM
What is CVE-2026-128123?
A denial of service vulnerability in the SvelteKit framework can be exploited when using the @sveltejs/adapter-node package. Specifically, between versions 5.5.7 and 5.5.8 and version 6.0.1, the framework allows the addition of headers to immutable requests. This behavior can lead to server crashes, interrupting service to all client requests routed to the affected server. The issue has been resolved in versions 5.5.8 and 6.0.1, ensuring more reliable service and stability for web applications built using SvelteKit.
Affected Version(s)
adapter-node >= 5.5.7, < 5.5.8 < 5.5.7, 5.5.8
adapter-node >= 6.0.0-next.0, < 6.0.1 < 6.0.0-next.0, 6.0.1
kit >= 3.0.0-next.0, < 3.1.1 < 3.0.0-next.0, 3.1.1