CVE-2026-128121

MediumCVSS 5.9/10Last modified Nov 13, 2026

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be emitted into the generated Vercel routing configuration without escaping regular-expression metacharacters. The configuration could consequently interpret the path as regular-expression syntax, match unintended application paths, and expose content or behavior outside the intended path. This issue is fixed in @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-116CWE-625

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 13, 2026
Last modified
Nov 13, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1281225.9SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 4.7.0 until versions 7.2.10 aCVE-2026-1281235.9SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 5.5.7 until versions 5.5.8 anCVE-2026-1281248.2AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Application.add_domain() converts every astCVE-2026-1281256.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized nameCVE-2026-1281268.7AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Request.post() does not limit the number ofCVE-2026-1281278.7AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.read_chunk() processing a muCVE-2026-1281287.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the C WebSocket reader adds a declared framCVE-2026-1281298.2AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection dCVE-2026-128136.3A vulnerability was detected in activepieces up to 0.83.0. This vulnerability affects the function handleUrlFile in the library packages/serCVE-2026-1281308.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, when the pipelined request queue is full, tCVE-2026-1281318.7AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payloCVE-2026-1281328.7AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader continues parsing fram
CVE-2026-128121: Medium severity, CVSS 5.9 | Vulnix