UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128121

SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static

Severity
Medium 5.9
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
2.70.4, 3.1.1
Weakness
Improper output encoding (CWE-116)CWE-625
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Sources
CVE Program

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be emitted into the generated Vercel routing configuration without escaping regular-expression metacharacters. The configuration could consequently interpret the path as regular-expression syntax, match unintended application paths, and expose content or behavior outside the intended path. This issue is fixed in @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1.

From the CVE Program.

Affected software

SoftwareAffected versions
SvelteKitServers and applications · cna:sveltejs|kit
  • Every version before 2.70.4
  • From 3.0.0-next.0 before 3.1.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-128121