CVE-2026-128117: SvelteKit: adapter-node crashes with an unhandled URIError when `reroute` rewrites malformed pathnames
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, the reroute hook could rewrite an invalid percent-encoded pathname into a valid route and reach a comparison that decoded the original malformed pathname outside the guarded decoding operation. The resulting unhandled URIError could crash an adapter-node server and deny service to other requests. This issue is fixed in 2.70.4 and 3.1.1.
Other sources
When reroute turned an invalid percent-encoded path into a valid path, it could potentially trigger a comparison that would crash the server.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@sveltejs/kitto a version that resolves this vulnerability.Fixed in 2.70.4 - Upgrade
Upgrade
npm/@sveltejs/kitto a version that resolves this vulnerability.Fixed in 3.1.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.70.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.1.1
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Adapter-node servers using SvelteKit versions earlier than 2.70.4 or 3.1.1 are affected when their reroute hook can rewrite an invalid percent-encoded pathname into a valid route. The crash can deny service to other requests handled by that server.
What does an attacker need to send to trigger the crash?
An attacker must make a request with a malformed percent-encoded pathname that is rewritten by the application's reroute hook into a valid route. No privileges or user interaction are required, but the attack complexity is rated high.
Are applications using the default routing behavior affected?
The described trigger depends on use of the reroute hook to transform the malformed pathname into a valid path. The provided information does not indicate that applications without such rerouting behavior are affected.
How can the issue be remediated?
Upgrade SvelteKit to version 2.70.4 or 3.1.1. These releases fix the unhandled URIError condition.