High severity · published Apr 10, 2026
CVE-2026-40074
SvelteKit's invalidated redirect in handle hook causes Denial-of-Service
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
kit · sveltejs
< 2.57.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40074
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40074
Patch
https://github.com/sveltejs/kit/commit/10d7b44425c3d9da642eecce373d0c6ef83b4fcd
Product
https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1
Vendor Advisory
https://github.com/sveltejs/kit/security/advisories/GHSA-3f6h-2hrp-w5wx
More from kit
9.1
CVE-2025-67647
SvelteKit Denial of service and possible SSRF when using prerendering
7.5
CVE-2026-114063
SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
7.5
CVE-2026-82261
SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
7.5
CVE-2026-82260
SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
7.5
CVE-2026-82259
SvelteKit 2.49.0 before 2.53.3 Denial of Service via form
