@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service

Description

redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input.

Recommendation

Update the @sveltejs/kit package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.57.0
• Patched version(s): 2.57.1

References

• GHSA-3f6h-2hrp-w5wx
• CVE-2026-40074
• CWE-755
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve - CVE-2026-22803
• jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133
• liquidjs has a Denial of Service via circular block reference in layout - CVE-2026-41311
• Parse Server: Denial of Service via unindexed database query for unconfigured auth providers - CVE-2026-33538

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@sveltejs/kit