CVE-2026-128122: Prerendered Redirect Rule Injection in @sveltejs/adapter-cloudflare

Vulnerability ID: CVE-2026-128122
CVSS Score: 5.9
Published: 2026-11-13

CVE-2026-128122 (GHSA-5wg4-q3ww-283h) is a build-time CRLF and wildcard injection vulnerability in @sveltejs/adapter-cloudflare. During the prerendering phase of a SvelteKit build, the adapter writes crawled redirect paths directly into the Cloudflare _redirects and _routes.json configuration files without output encoding or character validation. An attacker capable of controlling link paths on prerendered pages can inject newline characters, spaces, or wildcard patterns to forge arbitrary edge redirection rules, enabling asset hijacking and Stored Cross-Site Scripting (XSS).

TL;DR

Unsanitized prerendered redirect paths in @sveltejs/adapter-cloudflare allow attackers to inject arbitrary routing rules into Cloudflare _redirects and _routes.json files via CRLF sequences and wildcards, leading to JavaScript bundle hijacking and Stored XSS.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-128122 (GHSA-5wg4-q3ww-283h)
• Weakness Class: CWE-93 (CRLF Injection) / CWE-116 (Improper Output Encoding) / CWE-79 (XSS)
• CVSS v3.1 Score: 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
• Affected Component: @sveltejs/adapter-cloudflare (< 7.2.10, 8.0.0-next.0 - 8.0.1)
• Attack Vector: Network (Crafted links crawled during SvelteKit prerendering)
• Primary Impact: Arbitrary Cloudflare _redirects rule injection leading to asset hijacking and Stored XSS
• Exploit Status: Proof-of-Concept documented in advisory
• CISA KEV Status: Not Listed

Affected Systems

• @sveltejs/adapter-cloudflare (npm)
• SvelteKit applications deployed to Cloudflare Pages or Cloudflare Workers
• @sveltejs/adapter-cloudflare: >= 4.7.0, < 7.2.10 (Fixed in: 7.2.10)
• @sveltejs/adapter-cloudflare: >= 8.0.0-next.0, < 8.0.2 (Fixed in: 8.0.2)

Code Analysis

Commit: 679e0d8

Encode control characters and skip wildcard paths when generating Cloudflare _redirects and _routes.json (Main branch)

Commit: 0a2e58c

Backport fix for prerendered redirect rule injection to v2 branch (PR #17620)

Mitigation Strategies

• Upgrade @sveltejs/adapter-cloudflare to version 7.2.10 or 8.0.2 to enforce automatic percent-encoding of control characters and exclusion of wildcard paths.
• Audit generated _redirects and _routes.json build artifacts in CI/CD pipelines prior to deployment to Cloudflare Pages or Workers.
• Validate and URL-encode dynamic or user-supplied href attributes rendered on prerendered SvelteKit pages.

Remediation Steps:

1. Update package.json to require @sveltejs/adapter-cloudflare ^7.2.10 (for v7) or ^8.0.2 (for v8).
2. Run npm install (or the equivalent command for pnpm/yarn) to update lockfiles.
3. Execute a clean build (npm run build) and verify build logs for any warnings regarding skipped wildcard redirect rules.
4. Inspect the output _redirects file to verify that only expected single-line rules are present.
5. Redeploy the updated build output to Cloudflare Pages or Cloudflare Workers.

References

• CVE-2026-128122 Official CVE Record
• GitHub Security Advisory GHSA-5wg4-q3ww-283h
• SvelteKit Pull Request #17620
• Fix Commit on Main Branch (679e0d84ea9951bb4f1e458a599066b5a451b08a)
• Fix Commit on v2 Branch (0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd)
• Release Notes: @sveltejs/[email protected]
• Release Notes: @sveltejs/[email protected]

Read the full report for CVE-2026-128122 on our website for more details including interactive diagrams and full exploit analysis.