CVE-2026-128117

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, the reroute hook could rewrite an invalid percent-encoded pathname into a valid route and reach a comparison that decoded the original malformed pathname outside the guarded decoding operation. The resulting unhandled URIError could crash an adapter-node server and deny service to other requests. This issue is fixed in 2.70.4 and 3.1.1.

References

• https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd
• https://github.com/sveltejs/kit/commit/7993d5ebab017cb1be898a0b1c57371c5da06557
• https://github.com/sveltejs/kit/pull/17620
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.4
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1