CVE-2026-128117: Unhandled URIError Denial of Service in SvelteKit Request Routing

Vulnerability ID: CVE-2026-128117
CVSS Score: 5.9
Published: 2026-11-13

CVE-2026-128117 (GHSA-mw6w-2fmv-pvw3) is a denial of service (DoS) vulnerability in SvelteKit (@sveltejs/kit) caused by an uncaught URIError exception during request routing. When an application implements a reroute hook that rewrites a request pathname containing invalid percent-encoding into a valid route, SvelteKit subsequently calls decode_pathname on the original unvalidated url.pathname outside of a try...catch block. In deployments utilizing @sveltejs/adapter-node, this unhandled exception terminates the Node.js runtime process.

TL;DR

An unhandled URIError exception in SvelteKit's internal_respond routing pipeline allows unauthenticated remote attackers to crash Node.js servers using @sveltejs/adapter-node by sending malformed percent-encoded URLs to endpoints rewritten by a reroute hook.

⚠️ Exploit Status: POC

Technical Details

• CVE / GHSA ID: CVE-2026-128117 / GHSA-mw6w-2fmv-pvw3
• Weakness Class: CWE-248 (Uncaught Exception)
• CVSS v3.1 Score: 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
• Affected Package: @sveltejs/kit (< 2.70.4, >= 3.0.0 < 3.1.1)
• Vulnerable Function: internal_respond() in packages/kit/src/runtime/server/respond.js
• Primary Impact: Remote Denial of Service (Node.js process termination in adapter-node)
• Exploit Status: Proof of Concept Available
• CISA KEV Status: Not Listed

Affected Systems

• SvelteKit (@sveltejs/kit) < 2.70.4
• SvelteKit (@sveltejs/kit) >= 3.0.0, < 3.1.1
• Node.js applications built with @sveltejs/adapter-node
• @sveltejs/kit: < 2.70.4 (Fixed in: 2.70.4)
• @sveltejs/kit: >= 3.0.0, < 3.1.1 (Fixed in: 3.1.1)

Code Analysis

Commit: 7993d5e

fix: return 400 instead of throwing when reroute rewrites a malformed pathname

--- a/packages/kit/src/runtime/server/respond.js
+++ b/packages/kit/src/runtime/server/respond.js
@@ -295,17 +295,21 @@ export async function internal_respond(request, state) {
    /** @type {PageNodes | undefined} */
    let page_nodes;

+   /** @type {string} */
+   let decoded_pathname;
+
    try {
        resolved_path = decode_pathname(resolved_path);
+       // `reroute` can turn a malformed pathname into a valid one, so this must be decoded separately
+       decoded_pathname = decode_pathname(url.pathname);
    } catch {
        resolved_path = null;
        return await handle();
    }

    // try to serve the rerouted prerendered resource if it exists
    if (
-       // the resolved path has been decoded so it should be compared to the decoded url pathname
-       resolved_path !== decode_pathname(url.pathname) &&
+       resolved_path !== decoded_pathname &&
        !state.prerendering?.fallback &&
        has_prerendered_path(resolved_path)
    ) {

Commit: 0a2e58c

fix: backport security fixes to version 2 (#17620)

Mitigation Strategies

• Upgrade @sveltejs/kit to version 2.70.4 (for 2.x deployments) or 3.1.1 (for 3.x deployments).
• Validate url.pathname with decodeURI() inside a try...catch block at the beginning of the reroute hook and return undefined on failure.
• Configure upstream reverse proxies or Web Application Firewalls (WAFs) to reject HTTP requests containing malformed percent-encoding or invalid UTF-8 byte sequences in the URI.
• Enforce process supervision and automatic restart policies for all @sveltejs/adapter-node services.

Remediation Steps:

1. Inspect package.json and lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) to determine if @sveltejs/kit is < 2.70.4 or >= 3.0.0, < 3.1.1.
2. Check src/hooks.js and src/hooks.server.js to verify whether the application exports a reroute hook.
3. Run 'npm update @sveltejs/kit' (or equivalent pnpm/yarn command) to install @sveltejs/[email protected] or @sveltejs/[email protected].
4. Rebuild and redeploy the SvelteKit application bundle.
5. Verify the fix by sending a test request with a malformed percent-encoded path (e.g., '/%c0%ae/...') matching a reroute rule and confirming the server returns HTTP 400 Bad Request without crashing.

References

• GitHub Security Advisory GHSA-mw6w-2fmv-pvw3
• CVE-2026-128117 Record on CVE.org
• SvelteKit 3.x Fix Commit (7993d5ebab017cb1be898a0b1c57371c5da06557)
• SvelteKit 2.x Backport Commit (0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd)
• SvelteKit Backport Pull Request #17620
• Release @sveltejs/[email protected]
• Release @sveltejs/[email protected]
• CWE-248: Uncaught Exception
• CISA Known Exploited Vulnerabilities Catalog

Read the full report for CVE-2026-128117 on our website for more details including interactive diagrams and full exploit analysis.