UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128123

SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`

Severity
Medium 5.9
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
2.70.4, 3.1.1
Weakness
Uncaught exception (CWE-248)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Take it down
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Sources
CVE Program

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 5.5.7 until versions 5.5.8 and 6.0.1, , @sveltejs/adapter-node can attempt to add a header to an immutable request in a context that causes the server to crash, denying service to any other requests routed to that server. This issue is fixed in 5.5.8 and 6.0.1.

From the CVE Program.

Affected software

SoftwareAffected versions
SvelteKitServers and applications · cna:sveltejs|kit
  • Every version before 2.70.4
  • From 3.0.0-next.0 before 3.1.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-128123