CVE-2026-40074: CWE-755: Improper Handling of Exceptional Conditions in sveltejs kit
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.
AI Analysis
Technical Summary
SvelteKit, a web application framework, had a vulnerability (CWE-755) where calling redirect from the handle server hook with a location parameter containing characters invalid in HTTP headers caused an unhandled TypeError. This flaw could be exploited to cause a denial of service by passing unsanitized user input in the location parameter. The vulnerability affects all versions before 2.57.1 and has a CVSS 4.0 base score of 6.3, indicating medium severity. No official remediation level or patch links were provided in the source data, but the vulnerability is fixed in version 2.57.1.
Potential Impact
The vulnerability can cause a denial of service condition on affected platforms by triggering an unhandled TypeError when invalid characters are included in the redirect location parameter. This is particularly risky if the location parameter is derived from unsanitized user input, potentially allowing attackers to disrupt service availability.
Mitigation Recommendations
Upgrade SvelteKit to version 2.57.1 or later, where this vulnerability is fixed. Since no official patch links or vendor advisory were provided, verify the upgrade from the official SvelteKit release notes or repository. Avoid passing unsanitized user input to the redirect location parameter as a temporary mitigation. Patch status is not explicitly confirmed beyond the version fix note; check the vendor advisory for current remediation guidance.
CVE-2026-40074: CWE-755: Improper Handling of Exceptional Conditions in sveltejs kit
Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
SvelteKit, a web application framework, had a vulnerability (CWE-755) where calling redirect from the handle server hook with a location parameter containing characters invalid in HTTP headers caused an unhandled TypeError. This flaw could be exploited to cause a denial of service by passing unsanitized user input in the location parameter. The vulnerability affects all versions before 2.57.1 and has a CVSS 4.0 base score of 6.3, indicating medium severity. No official remediation level or patch links were provided in the source data, but the vulnerability is fixed in version 2.57.1.
Potential Impact
The vulnerability can cause a denial of service condition on affected platforms by triggering an unhandled TypeError when invalid characters are included in the redirect location parameter. This is particularly risky if the location parameter is derived from unsanitized user input, potentially allowing attackers to disrupt service availability.
Mitigation Recommendations
Upgrade SvelteKit to version 2.57.1 or later, where this vulnerability is fixed. Since no official patch links or vendor advisory were provided, verify the upgrade from the official SvelteKit release notes or repository. Avoid passing unsanitized user input to the redirect location parameter as a temporary mitigation. Patch status is not explicitly confirmed beyond the version fix note; check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-09T00:39:12.205Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d9d9721cc7ad14da3f8648
Added to database: 4/11/2026, 5:17:38 AM
Last enriched: 4/11/2026, 5:18:41 AM
Last updated: 4/11/2026, 3:39:16 PM
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.