CVE-2026-128122: SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`
If an attacker can influence the links crawled during prerendering, they can influence the redirects entries that are added to the Cloudflare platform redirects generated during the adapt phase of the build.
Other sources
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 4.7.0 until versions 7.2.10 and 8.0.2, @sveltejs/adapter-cloudflare allowed an attacker-influenced link crawled during prerendering to place whitespace, control characters, wildcards, or placeholders into a prerendered redirect path. The adapter wrote those paths into the Cloudflare redirects output without output-context validation, allowing a path to create unintended routing rules that could redirect or expose requests beyond the intended prerendered route. This issue is fixed in 7.2.10 and 8.0.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@sveltejs/adapter-cloudflareto a version that resolves this vulnerability.Fixed in 8.0.2 - Upgrade
Upgrade
npm/@sveltejs/adapter-cloudflareto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
@sveltejs/adapter-cloudflareto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
@sveltejs/adapter-cloudflareto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using @sveltejs/adapter-cloudflare from version 4.7.0 up to, but not including, 7.2.10 or 8.0.2 are affected when prerendering crawls attacker-influenced links. The issue concerns the Cloudflare _redirects file generated during the build adapt phase.
What does an attacker need to exploit this issue?
An attacker must be able to influence links that are crawled during prerendering. Crafted redirect paths containing whitespace, control characters, wildcards, or placeholders can then be written as unintended routing rules in the generated _redirects output.
What versions resolve the issue?
Upgrade @sveltejs/adapter-cloudflare to version 7.2.10 or 8.0.2. These versions fix the missing output-context validation for prerendered redirect paths.