CVE-2026-128121: Regular Expression Injection in SvelteKit Vercel Route Configuration via @sveltejs/adapter-vercel and @sveltejs/adapter-static

Vulnerability ID: CVE-2026-128121
CVSS Score: 5.9
Published: 2026-11-13

A vulnerability classified under CWE-116 (Improper Encoding or Escaping of Output) and CWE-625 (Permissive Regular Expression) exists in the @sveltejs/adapter-vercel and @sveltejs/adapter-static packages for SvelteKit. During the build-time prerendering phase, pathnames discovered by the SvelteKit link crawler are inserted into the generated Vercel routing configuration (.vercel/output/config.json) without escaping regular expression metacharacters. Because the Vercel edge routing engine evaluates the 'src' property of route entries as regular expressions, an attacker capable of injecting links into prerendered application content can introduce arbitrary regular expression syntax, hijacking application routing and exposing unintended assets or responses.

TL;DR

Unescaped prerendered pathnames in @sveltejs/adapter-vercel and @sveltejs/adapter-static allow attacker-influenced links containing regular expression metacharacters to hijack Vercel routing rules and expose unintended paths.

Technical Details

• CWE ID: CWE-116 (Improper Encoding or Escaping of Output) / CWE-625 (Permissive Regular Expression)
• CVSS v3.1 Score: 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
• Attack Vector: Network (Build-Time Prerender Link Injection)
• Affected Components: @sveltejs/adapter-vercel (< 6.3.5, < 7.0.2), @sveltejs/adapter-static (< 3.0.11, < 4.0.1)
• Primary Impact: High Confidentiality Impact via Vercel Route Hijacking and Unintended Path Matching
• Exploit Status: No known public exploits or active exploitation
• CISA KEV Status: Not Listed

Affected Systems

• @sveltejs/adapter-vercel
• @sveltejs/adapter-static
• @sveltejs/kit
• @sveltejs/adapter-vercel: < 6.3.5 (Fixed in: 6.3.5)
• @sveltejs/adapter-vercel: >= 7.0.0-next.0, < 7.0.2 (Fixed in: 7.0.2)
• @sveltejs/adapter-static: < 3.0.11 (Fixed in: 3.0.11)
• @sveltejs/adapter-static: >= 4.0.0-next.0, < 4.0.1 (Fixed in: 4.0.1)
• kit: < 2.70.4 (Fixed in: 2.70.4)
• kit: >= 3.0.0-next.0, < 3.1.1 (Fixed in: 3.1.1)

Code Analysis

Commit: 2ed61a6

Primary fix introducing escape_src() hexadecimal escaping for Vercel route configuration in @sveltejs/adapter-vercel and @sveltejs/adapter-static

--- a/packages/adapter-vercel/index.js
+++ b/packages/adapter-vercel/index.js
@@ -575,8 +581,10 @@ function static_vercel_config(builder, config, dir) {
    /** @type {import('./index.js').ImagesConfig | undefined} */
    const images = config.images;

-   for (let [src, redirect] of builder.prerendered.redirects) {
-       if (src.replace(/\/$/, '') === redirect.location.replace(/\/$/, '')) {
+   for (const [path, redirect] of builder.prerendered.redirects) {
+       let src = escape_src(path);
+
+       if (path.replace(/\/$/, '') === redirect.location.replace(/\/$/, '')) {
            // ignore the extreme edge case of a `/foo` -> `/foo/` redirect,
            // which would only arise if the response was generated by a
            // `handle` hook or outside the app altogether (since you
@@ -608,8 +616,8 @@ function static_vercel_config(builder, config, dir) {
            }

            prerendered_redirects.push(
-               { src: path, dest: counterpart_route },
-               { src: counterpart_route, status: 308, headers: { Location: path } }
+               { src: escape_src(path), dest: counterpart_route },
+               { src: escape_src(counterpart_route), status: 308, headers: { Location: path } }
            );
        }

Commit: 0a2e58c

Backport of Vercel route configuration regex escaping fixes to SvelteKit v2 release branch (#17620)

Mitigation Strategies

• Upgrade @sveltejs/adapter-vercel and @sveltejs/adapter-static to patched releases that apply hexadecimal escaping to prerendered route patterns.
• Enforce strict allowlist validation on dynamic route parameters during prerendering so that paths containing regular expression metacharacters return 404 and are excluded from the routing configuration.
• Disable automatic link crawling (kit.prerender.crawl = false) on routes that render untrusted or user-generated HTML links.
• Audit .vercel/output/config.json in CI/CD build pipelines to detect unescaped regular expression metacharacters in route 'src' properties before deployment.

Remediation Steps:

1. Update @sveltejs/adapter-vercel to version 6.3.5 or >= 7.0.2 in package.json.
2. Update @sveltejs/adapter-static to version 3.0.11 or >= 4.0.1 in package.json if used to deploy to Vercel.
3. Run a clean build and redeploy the application to Vercel so that .vercel/output/config.json is regenerated with escaped route patterns.
4. Verify in .vercel/output/config.json that any special characters in prerendered route 'src' strings are encoded using \xHH hexadecimal sequences.

References

• GitHub Security Advisory GHSA-jf9x-2fg2-hx4w
• SvelteKit Pull Request #17620 (v2 Backport)
• Fix Commit 2ed61a6aa3ac230b89e3528654c587847d1525a0
• Backport Commit 0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd
• Release @sveltejs/[email protected]
• Release @sveltejs/[email protected]
• Release @sveltejs/[email protected]
• Release @sveltejs/[email protected]
• CVE-2026-128121 Record on CVE.org

Read the full report for CVE-2026-128121 on our website for more details including interactive diagrams and full exploit analysis.