Svelte Framework Redirect Vulnerability in SvelteKit

CVE-2026-40074

What is CVE-2026-40074?

SvelteKit, a framework designed for building high-performance web applications using Svelte, is susceptible to a vulnerability in its redirect functionality. When the redirect method is invoked within the handle server hook, an improper handling of invalid characters in the location parameter can result in an unhandled TypeError. This scenario poses a risk of Denial of Service (DoS), particularly if the location used includes unsanitized user input. This vulnerability is addressed in version 2.57.1, which eliminates the potential for disruption during application redirect processes.

References