CVE-2026-128123: Uncaught Exception and Denial of Service in SvelteKit @sveltejs/adapter-node

Vulnerability ID: CVE-2026-128123
CVSS Score: 5.9
Published: 2026-11-13

A Denial of Service (DoS) vulnerability exists in @sveltejs/adapter-node versions 5.5.7 and 6.0.0-next.0 through 6.0.0. When a SvelteKit server route returns a direct response from a fetch() call with a Content-Type of text/event-stream, the Node.js adapter attempts to mutate the response headers to disable proxy buffering. Because headers returned directly by the WHATWG Fetch API carry an immutable guard, this mutation throws an unhandled TypeError, terminating the underlying Node.js process and denying service to all active and subsequent clients.

TL;DR

@sveltejs/adapter-node crashes with an uncaught TypeError when handling proxied text/event-stream responses returned directly from fetch(), allowing remote attackers to trigger a complete Denial of Service against affected routes.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability ID: CVE-2026-128123 / GHSA-rqw3-x7hx-mm3p
• Weakness Class: CWE-248 (Uncaught Exception)
• Attack Vector: Network (HTTP Request to SSE Proxy Route)
• CVSS v3.1 Score: 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
• Primary Impact: Denial of Service (Node.js Process Crash)
• Affected Component: @sveltejs/adapter-node (packages/adapter-node/src/handler.js)
• Exploit Status: PoC in Official Test Suite
• CISA KEV Status: Not Listed

Affected Systems

• @sveltejs/adapter-node
• SvelteKit Node.js deployments
• @sveltejs/adapter-node: = 5.5.7 (Fixed in: 5.5.8)
• @sveltejs/adapter-node: >= 6.0.0-next.0, < 6.0.1 (Fixed in: 6.0.1)

Code Analysis

Commit: 04756a1

fix: avoid crashing the server when a text/event-stream response has immutable headers

File: packages/adapter-node/src/handler.js
@@ -120,8 +120,10 @@ const ssr = async (req, res) => {
    // `cache-control`), which breaks streaming responses like server-sent events.
    // `X-Accel-Buffering: no` opts out of that buffering and is a no-op on proxies
    // that don't recognise it. See https://github.com/sveltejs/kit/issues/15790
+   // The header is set on the Node response rather than the `Response` object,
+   // whose headers may be immutable (e.g. when returned from `fetch`)
    if (response.headers.get('content-type') === 'text/event-stream') {
-       response.headers.set('x-accel-buffering', 'no');
+       res.setHeader('x-accel-buffering', 'no');
    }

    setResponse(res, response);

Commit: 0a2e58c

fix: backport security fixes to version 2 (#17620)

Exploit Details

• GitHub: Official SvelteKit regression test suite containing reproduction route for proxied text/event-stream fetch responses.

Mitigation Strategies

• Upgrade @sveltejs/adapter-node to version 5.5.8, 6.0.1, or later to ensure the X-Accel-Buffering header is applied to the mutable Node.js ServerResponse object rather than the Web Standard Response.
• Reconstruct proxied fetch() responses using new Response() and new Headers() in route handlers to strip the immutable guard before passing the response to the adapter.
• Configure process supervisors (systemd, PM2, Docker, or Kubernetes) with automatic restart policies to recover from unhandled process termination.

Remediation Steps:

1. Inspect package.json and lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) to determine if @sveltejs/adapter-node version 5.5.7 or 6.0.0-next.0 through 6.0.0 is installed.
2. Update @sveltejs/adapter-node to >= 5.5.8 or >= 6.0.1 using npm, pnpm, or yarn.
3. Rebuild the SvelteKit application (npm run build) so the updated handler.js file is emitted into the build output directory.
4. Redeploy the compiled Node.js server artifact and verify that routes returning proxied text/event-stream responses do not terminate the process.

References

• GitHub Security Advisory: GHSA-rqw3-x7hx-mm3p
• CVE-2026-128123 Official Record
• Fix Commit: 04756a1f7a4f73e34f1934895340a46de84fc164
• Backport Commit: 0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd
• SvelteKit Pull Request #17620
• Release Notes: @sveltejs/[email protected]
• Release Notes: @sveltejs/[email protected]

Read the full report for CVE-2026-128123 on our website for more details including interactive diagrams and full exploit analysis.