@SVELTEJS/ADAPTER-CLOUDFLARE · GHSA-5wg4-q3ww-283h · Package
FIX → 8.0.2 · 7.2.10
The Cloudflare adapter for SvelteKit writes a _redirects file during build, and prerendered redirect paths are not sanitized before being added to it. An attacker who can influence the links crawled during prerendering can inject arbitrary redirect rules into the generated file.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Projects using @sveltejs/adapter-cloudflare that prerender pages and crawl links from sources an attacker can influence, such as user-generated content. Projects that do not prerender, or whose crawled links are fully controlled by the team, are unlikely to be exposed.
Not affected if controlled-links, no-prerendering, static-export
Who cares cloudflare, npm, sveltekit
npm ls @sveltejs/adapter-cloudflare_redirects file in the build output of the Cloudflare deployment and review it for unexpected rulesUpgrade to 8.0.2 · 7.2.10
@sveltejs/adapter-cloudflare 7.2.10 for the 7.x lineIf an attacker can influence the links crawled during prerendering, they can influence the redirects entries that are added to the Cloudflare platform redirects generated during the adapt phase of the build.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
@sveltejs/adapter-cloudflare 8.0.2 for the 8.x line