Packages / @sveltejs/kit / Security

ModerateVulnerabilityGHSA-3f6h-2hrp-w5wxCVE-2026-40074Published 10 Apr 2026

@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service

Affected releases · @sveltejs/kit

  • 2.x2.0.0 – 2.57.0Fixed in 2.57.1
  • 1.x and older0.0.8 – 1.30.4No fix, no longer updated

On 2.x, the newest line:

npm install @sveltejs/kit@2.57.1
3.x

  1. Not affected

    3.0.0 – 3.1.0

    3 releases, latest

2.x

  1. Affected

    2.0.0 – 2.57.0

    211 releases

  2. Fixed

    2.57.1 – 2.70.3

    26 releases

1.x

  1. Affected

    1.0.0 – 1.30.4

    128 releases

0.x

  1. Affected

    0.0.8 – 0.0.30

    21 releases

389 stable releases of @sveltejs/kit, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @sveltejs/kit. It is read in your browser and sent nowhere.

What happens

redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input.