CVE-2026-40074: Svelte SvelteKit denial of service in redirect function

CVE-2026-40074 · Severity: high · CVSS 7.5 · Published 2026-04-10

Svelte Kit is a popular web development framework used to build server-side applications. A vulnerability in its redirect functionality allows attackers to crash the application by providing malformed location strings to the server-side handle hook. If user input is passed directly to the redirect function without validation, an attacker can trigger an unhandled error that disrupts service availability.

Technologies: @sveltejs/kit (npm), Svelte Kit, SvelteKit. Vendors: npm, Svelte.

Quick answers

Is CVE-2026-40074 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40074 being exploited in the wild.
How severe is CVE-2026-40074?
High severity, with a CVSS score of 7.5, published 10 April 2026.
Which products and versions are affected?
@sveltejs/kit (npm) <= 2.57.0, SEMVER:introduced=0,fixed=2.57.1; Svelte Kit < 2.57.1, <= 2.57.0.
Is there a fix for CVE-2026-40074?
Yes. @sveltejs/kit (npm): upgrade to 2.57.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40074 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40074?
Check whether you run @sveltejs/kit (npm), Svelte Kit or SvelteKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @sveltejs/kit (npm): upgrade to 2.57.1 or later
    npm install @sveltejs/kit@2.57.1

Technical details

The vulnerability exists in the redirect() function when invoked from the handle server hook (CWE-755: Improper Handling of Exceptional Conditions). When the location parameter contains characters that are invalid in HTTP header values, the function throws an unhandled TypeError instead of gracefully handling or validating the input. The attack vector is network-based with low complexity; no privileges or user interaction are required, though attack requirements (AT:P) are present according to CVSS v4 metrics. An attacker can exploit this by crafting HTTP requests that cause the handle hook to call redirect() with unsanitized user-controlled input containing invalid header characters. This results in application crash and service unavailability. The fix, released in @sveltejs/kit version 2.57.1, implements better validation of redirect input parameters to prevent invalid HTTP header characters.

Affected products

  • Svelte @sveltejs/kit <= 2.57.0

Identifiers

  • CVE-2026-40074
  • GHSA-3f6h-2hrp-w5wx

Timeline

  • 2026-04-10: disclosed: Vulnerability disclosed via GitHub advisory GHSA-3f6h-2hrp-w5wx
  • 2026-04-09: patched: Patch released in @sveltejs/kit version 2.57.1 with improved redirect input validation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.