Executive brief
Svelte Kit is a popular web development framework used to build server-side applications. A vulnerability in its redirect functionality allows attackers to crash the application by providing malformed location strings to the server-side handle hook. If user input is passed directly to the redirect function without validation, an attacker can trigger an unhandled error that disrupts service availability.
Technical details
The vulnerability exists in the redirect() function when invoked from the handle server hook (CWE-755: Improper Handling of Exceptional Conditions). When the location parameter contains characters that are invalid in HTTP header values, the function throws an unhandled TypeError instead of gracefully handling or validating the input. The attack vector is network-based with low complexity; no privileges or user interaction are required, though attack requirements (AT:P) are present according to CVSS v4 metrics. An attacker can exploit this by crafting HTTP requests that cause the handle hook to call redirect() with unsanitized user-controlled input containing invalid header characters. This results in application crash and service unavailability. The fix, released in @sveltejs/kit version 2.57.1, implements better validation of redirect input parameters to prevent invalid HTTP header characters.
Affected products
- Svelte @sveltejs/kit <= 2.57.0
Timeline
- 2026-04-10: disclosed: Vulnerability disclosed via GitHub advisory GHSA-3f6h-2hrp-w5wx
- 2026-04-09: patched: Patch released in @sveltejs/kit version 2.57.1 with improved redirect input validation
References
- https://github.com/sveltejs/kit/security/advisories/GHSA-3f6h-2hrp-w5wx
- https://github.com/sveltejs/kit/commit/10d7b44425c3d9da642eecce373d0c6ef83b4fcd
- https://github.com/sveltejs/kit
- https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.57.1
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1