@SVELTEJS/ADAPTER-VERCEL · GHSA-jf9x-2fg2-hx4w · Package
FIX → 7.0.2 · 6.3.5 · 4.0.1 · 3.0.11
The Vercel and static adapters for SvelteKit write prerendered page paths into Vercel routing config as regular expressions without escaping them. A path crawled during prerendering that an attacker influenced could be read as a regex pattern, which could change how routes match.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Projects that use @sveltejs/adapter-vercel or @sveltejs/adapter-static to build a SvelteKit site with prerendered pages. The flaw needs a crawled link that an attacker can influence during the prerender phase; sites with no prerendered routes or no such link have less exposure. The sources do not say how far a bad route match could reach in practice.
Not affected if managed-hosting-without-adapter, no-prerendered-paths
Who cares npm, svelte, sveltekit, vercel
npm ls @sveltejs/adapter-vercel @sveltejs/adapter-static@sveltejs/adapter-vercel or @sveltejs/adapter-static in package.json and package-lock.jsonIf an attacker could influence a link that was crawled during the prerender phase, that link could later be interpreted as a regex in the Vercel routing configuration.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 7.0.2 · 6.3.5 · 4.0.1 · 3.0.11
6.3.5 (6 line) or 7.0.2 (7 line)3.0.11 (3 line) or 4.0.1 (4 line)