SvelteKit, a web application framework, had an improper handling of exceptional conditions (CWE-755) in its redirect function when used inside the handle server hook. If the location parameter passed to redirect contains characters invalid in HTTP headers, it triggers an unhandled TypeError, potentially causing a denial of service. This affects all versions prior to 2.57.1. The vulnerability has a CVSS 4.0 base score of 6.3, indicating medium severity. No known exploits are reported in the wild. The vulnerability is fixed in SvelteKit version 2.57.1.

The vulnerability can cause a denial of service on affected platforms by triggering an unhandled TypeError when invalid characters are passed to the redirect function inside the handle server hook. This is especially risky if the location parameter includes unsanitized user input, allowing attackers to disrupt service availability. There is no indication of remote code execution or data breach. No known exploits have been reported.

Upgrade SvelteKit to version 2.57.1 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 2.57.1, applying this official update is the recommended remediation. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.