CVE-2026-40074

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-755

Affected software

Vendor	Product	Versions
sveltejs	kit	< 2.57.1

References

https://github.com/sveltejs/kit/commit/10d7b44425c3d9da642eecce373d0c6ef83b4fcdPatch
https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1Product, Release Notes
https://github.com/sveltejs/kit/security/advisories/GHSA-3f6h-2hrp-w5wxVendor Advisory

Timeline

Published: Apr 10, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-400757.5OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, th CVE-2026-400768.8OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, th CVE-2026-400773.1Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed w CVE-2026-400799.8Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lac CVE-2026-40088.8A flaw has been found in Tenda W3 1.0.0.3(2204). This issue affects some unknown processing of the file /goform/wifiSSIDset of the component CVE-2026-400806.1Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a subs CVE-2026-400825.4Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after log CVE-2026-400837.2Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unseria CVE-2026-400846.5Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the CVE-2026-400865.3Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated CVE-2026-400875.3LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template CVE-2026-400889.6PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-con