CVE-2026-40074
Last modified
CVE-2026-40074 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. EPSS estimates a 0.37% chance of exploitation in the next 30 days.
Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Svelte | Kit | < 2.57.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-40074?
How severe is CVE-2026-40074?
How do I fix CVE-2026-40074?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-40069BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.…7.5
- CVE-2026-4007A vulnerability was detected in Tenda W3 1.0.0.3(2204). This…8.8
- CVE-2026-40070BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.…8.1
- CVE-2026-40071pyLoad is a free and open-source download manager written in…5.4
- CVE-2026-40072web3.py allows you to interact with the Ethereum blockchain …7.2
- CVE-2026-40073SvelteKit is a framework for rapidly developing robust, perf…7.5
- CVE-2026-40075OpenMRS Core is an open source electronic medical record sys…7.5
- CVE-2026-40076OpenMRS Core is an open source electronic medical record sys…8.8
- CVE-2026-40077Beszel is a server monitoring platform. Prior to 0.18.7, som…3.1
- CVE-2026-40079Cacti is an open source performance and fault management fra…9.8
- CVE-2026-4008A flaw has been found in Tenda W3 1.0.0.3(2204). This issue …8.8
- CVE-2026-40080Cacti is an open source performance and fault management fra…6.1
Are you affected by CVE-2026-40074?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST