High severity7.5NVD Advisory· Published Apr 10, 2026· Updated Apr 15, 2026
CVE-2026-40074
CVE-2026-40074
Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@sveltejs/kitnpm | < 2.57.1 | 2.57.1 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/sveltejs/kit/commit/10d7b44425c3d9da642eecce373d0c6ef83b4fcdnvdPatchWEB
- github.com/advisories/GHSA-3f6h-2hrp-w5wxghsaADVISORY
- github.com/sveltejs/kit/security/advisories/GHSA-3f6h-2hrp-w5wxnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-40074ghsaADVISORY
- github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.57.1ghsaWEB
- github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.