Servers and applications

CVE-2026-128117

Unhandled URIError when `reroute` rewrites a malformed pathname crashes adapter-node

Severity: Medium 5.9
Published: 29 Oct 2026
Last changed: 13 Nov 2026
Added to UpHeron: 13 Nov 2026
Fixed in: 2.70.4, 3.1.1
Weakness: Uncaught exception (CWE-248)
Attack: Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can: Take it down
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Also known as: GHSA-mw6w-2fmv-pvw3
Sources: CVE Program, Project advisories (GitHub)

Description

When reroute turned an invalid percent-encoded path into a valid path, it could potentially trigger a comparison that would crash the server.

Software	Affected versions
SvelteKitServers and applications · `cna:sveltejs\|kit`	Every version before 2.70.4 From 3.0.0 before 3.1.1
SvelteKitServers and applications · `github:sveltejs/kit`	From 3.0.0 before 3.1.1

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-128117
GitHub Advisory Database https://github.com/advisories/GHSA-mw6w-2fmv-pvw3
github.com https://github.com/sveltejs/kit/security/advisories/GHSA-mw6w-2fmv-pvw3