CVE-2026-128123: SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`

Q: What conditions are needed to trigger the denial of service?

The affected server must proxy certain requests through fetch in a context where it attempts to modify an immutable request. The CVSS vector indicates network-based exploitation requires no privileges or user interaction, but has high attack complexity.

Q: Which releases contain the fix?

The issue is fixed in versions 5.5.8 and 6.0.1. Version 5.5.7 is identified as affected.

Q: How can I assess whether an application is exposed?

Check whether the application deploys @sveltejs/adapter-node and proxies requests via fetch. Applications using an affected version in this request-handling context may be vulnerable to a server crash that disrupts other requests routed to that server.

Published Nov 13, 2026

Updated

In affected versions, @sveltejs/adapter-node can attempt to add a header to an immutable request in a context that causes the server to crash, denying service to any other requests routed to that server.

Other sources

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 5.5.7 until versions 5.5.8 and 6.0.1, , @sveltejs/adapter-node can attempt to add a header to an immutable request in a context that causes the server to crash, denying service to any other requests routed to that server. This issue is fixed in 5.5.8 and 6.0.1.

— MITRE

Affected Software

2 affected componentsFixes available

npm/@sveltejs/adapter-node>=6.0.0-next.0<6.0.1

6.0.1

npm/@sveltejs/adapter-node>=5.5.7<5.5.8

5.5.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@sveltejs/adapter-node to a version that resolves this vulnerability.
Fixed in 6.0.1
Upgrade
Upgrade npm/@sveltejs/adapter-node to a version that resolves this vulnerability.
Fixed in 5.5.8
Upgrade
Upgrade @sveltejs/adapter-node to a version that resolves this vulnerability.
Fixed in 5.5.8
Upgrade
Upgrade @sveltejs/adapter-node to a version that resolves this vulnerability.
Fixed in 6.0.1

Event History

Nov 13, 2026

CVE Published

via MITRE·07:54 PM

Data Sourced

via MITRE·07:54 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:18 PM

DescriptionSeverityWeakness

Advisory Published

via GitHub·08:36 PM

Data Sourced

via GitHub·08:36 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What conditions are needed to trigger the denial of service?

The affected server must proxy certain requests through fetch in a context where it attempts to modify an immutable request. The CVSS vector indicates network-based exploitation requires no privileges or user interaction, but has high attack complexity.

Which releases contain the fix?

The issue is fixed in versions 5.5.8 and 6.0.1. Version 5.5.7 is identified as affected.

How can I assess whether an application is exposed?

Check whether the application deploys @sveltejs/adapter-node and proxies requests via fetch. Applications using an affected version in this request-handling context may be vulnerable to a server crash that disrupts other requests routed to that server.

CVE-2026-128123: SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are needed to trigger the denial of service?

Which releases contain the fix?

How can I assess whether an application is exposed?

Company

Resources

Contact

Frequently Asked Questions

What conditions are needed to trigger the denial of service?

Which releases contain the fix?

How can I assess whether an application is exposed?