GHSA-3f6h-2hrp-w5wxMedium

@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service

Published
April 10, 2026
Last Modified
April 10, 2026

🔗 CVE IDs covered (1)

📋 Description

redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input.

🎯 Affected products1

  • npm/@sveltejs/kit:<= 2.57.0

🔗 References (6)