CVE-2026-128121

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be emitted into the generated Vercel routing configuration without escaping regular-expression metacharacters. The configuration could consequently interpret the path as regular-expression syntax, match unintended application paths, and expose content or behavior outside the intended path. This issue is fixed in @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1.

References

• https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd
• https://github.com/sveltejs/kit/commit/2ed61a6aa3ac230b89e3528654c587847d1525a0
• https://github.com/sveltejs/kit/pull/17620
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-static@3.0.11
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-static@4.0.1