Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-10 | 1 | General1 |
| 2026-04-28 | 1 | Disclosure1 |
CVE-2026-40074 SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server… https://www.cve.org/CVERecord?id=CVE-2026-40074
Post summary
The text references CVE-2026-40074 and links to its record, providing minimal technical context but no details on PoC, exploits, active use, or patches.
CVE-2026-40074: CVE-2026-40074: Denial of Service via Unhandled Exceptions in SvelteKit Redirects SvelteKit versions prior to 2.57.1 are vulnerable to a Denial of Service (DoS) condition due to improper handling of exceptional conditions in the `redir... https://cvereports.com/reports/CVE-2026-40074
Post summary
A DoS vulnerability in SvelteKit is disclosed, affecting pre‑2.57.1 versions due to unhandled redirect exceptions; no PoC, exploit, or active usage is reported, and no patch is referenced.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | svelte | kit | - | node.js | - |