@SVELTEJS/KIT · GHSA-mw6w-2fmv-pvw3 · Package
FIX → 3.1.1 · 2.70.4
When the reroute hook turns an invalid percent-encoded path into a valid one, an unhandled URIError can crash the SvelteKit server built with adapter-node. An attacker who sends such a request can take the server down, causing a denial of service.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use a reroute hook and run on the Node adapter are exposed, since the crash happens when reroute rewrites a malformed path. Apps on static export or other adapters, or without a reroute hook, are not affected by this report. Apps that upgrade to the fixed versions are protected.
Not affected if managed-hosting, no-reroute-hook, static-export
Who cares adapter-node, node, self-hosted, sveltekit
@sveltejs/kit in package.json and the lockfile.reroute hook in src/hooks.js or src/hooks.ts.@sveltejs/adapter-node.When reroute turned an invalid percent-encoded path into a valid path, it could potentially trigger a comparison that would crash the server.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 3.1.1 · 2.70.4
@sveltejs/kit 2.70.4 for the 2.x line@sveltejs/kit 3.1.1 for the 3.x line