CVE-2026-40074: SvelteKit's invalidated redirect in handle hook causes Denial-of-Service
redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input.
Other sources
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40074?
CVE-2026-40074 has a severity rating that indicates it could lead to a Denial-of-Service vulnerability under certain conditions.
How do I fix CVE-2026-40074?
To fix CVE-2026-40074, upgrade to version 2.57.1 or later of the @sveltejs/kit package.
What platforms are affected by CVE-2026-40074?
CVE-2026-40074 may affect various platforms running vulnerable versions of the @sveltejs/kit package.
What causes the Denial-of-Service vulnerability in CVE-2026-40074?
The Denial-of-Service in CVE-2026-40074 is caused by an unhandled TypeError when invalid characters are present in the location parameter of an HTTP header.
Is there a workaround for CVE-2026-40074 before upgrading?
Currently, the recommended action for CVE-2026-40074 is to upgrade to a patched version, as specific workarounds may not fully mitigate the risk.