Description
redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input.
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.57.0
- Patched version(s): 2.57.1
References
Could your website be exposed too?
SmartScanner can check your website for @sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service and gives you actionable findings to investigate.
Start a free scanRelated Issues
- jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133
- @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve - CVE-2026-22803
- StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service - CVE-2026-30945
- OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header - CVE-2026-59892
You might also like:
See something that needs correcting? Let us knowUpdated April 10, 2026