{"id":"GHSA-mw6w-2fmv-pvw3","kind":"vulnerability","aliases":["GHSA-mw6w-2fmv-pvw3"],"related":[],"title":"Unhandled URIError when `reroute` rewrites a malformed pathname crashes adapter-node","description":"When `reroute` turned an invalid percent-encoded path into a valid path, it could potentially trigger a comparison that would crash the server.","summary":"When the reroute hook turns an invalid percent-encoded path into a valid one, an unhandled URIError can crash the SvelteKit server built with adapter-node. An attacker who sends such a request can take the server down, causing a denial of service.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@sveltejs/kit","note":"<=2.70.3, >= 3.0.0, <= 3.1.0","fixed":["2.70.4","3.1.1"],"affected":"<= 2.70.3, >= 3.0.0, <= 3.1.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["adapter-node","cwe-248","node","package","self-hosted","sveltekit"],"not_affected_if":["managed-hosting","no-reroute-hook","static-export"],"how_to_check":"- Check the installed version of `@sveltejs/kit` in `package.json` and the lockfile.\n- Look for a `reroute` hook in `src/hooks.js` or `src/hooks.ts`.\n- Confirm the app deploys with `@sveltejs/adapter-node`.","fix":"- `@sveltejs/kit` `2.70.4` for the 2.x line\n- `@sveltejs/kit` `3.1.1` for the 3.x line","status":"open","published_at":"2026-10-29T23:47:35+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","triaged_at":"2026-11-09T22:56:11+00:00","updated_at":"2026-11-09T22:56:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T22:56:11Z","model":"claude-haiku-5-5","output":{"fix":"- `@sveltejs/kit` `2.70.4` for the 2.x line\n- `@sveltejs/kit` `3.1.1` for the 3.x line","reach":"internet","title":"SvelteKit: malformed path rewritten by reroute crashes the Node adapter server","impact":"low","summary":"When the reroute hook turns an invalid percent-encoded path into a valid one, an unhandled URIError can crash the SvelteKit server built with adapter-node. An attacker who sends such a request can take the server down, causing a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["sveltekit","adapter-node","self-hosted","node"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote requests crash the server process, causing denial of service","analyst_note":"","how_to_check":"- Check the installed version of `@sveltejs/kit` in `package.json` and the lockfile.\n- Look for a `reroute` hook in `src/hooks.js` or `src/hooks.ts`.\n- Confirm the app deploys with `@sveltejs/adapter-node`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-reroute-hook","static-export","managed-hosting"],"who_is_affected":"Applications that use a `reroute` hook and run on the Node adapter are exposed, since the crash happens when reroute rewrites a malformed path. Apps on static export or other adapters, or without a reroute hook, are not affected by this report. Apps that upgrade to the fixed versions are protected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000755,"input_tokens":4606,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-248':28B '2fmv':16A,21A 'adapt':11A,25B,61B 'adapter-nod':10A,24B,60B 'attack':64B 'built':58B 'caus':75B 'comparison':98C 'could':94C 'crash':9A,54B,101C 'cwe':27B 'denial':77B 'encod':44B,87C 'ghsa':14A,19A 'ghsa-mw6w-2fmv-pvw3':13A,18A 'hook':38B 'host':33B 'invalid':41B,84C 'malform':7A 'mw6w':15A,20A 'node':12A,26B,29B,62B 'one':49B 'packag':30B 'path':45B,88C,92C 'pathnam':8A 'percent':43B,86C 'percent-encod':42B,85C 'potenti':95C 'pvw3':17A,22A 'request':69B 'rerout':4A,37B,81C 'rewrit':5A 'self':32B 'self-host':31B 'send':66B 'server':57B,73B,103C 'servic':79B 'sveltejs/kit':23A 'sveltekit':34B,56B 'take':71B 'trigger':96C 'turn':39B,82C 'unhandl':1A,51B 'urierror':2A,52B 'valid':48B,91C 'would':100C","nicknames":[],"mitigations":[],"who_affected":"Applications that use a `reroute` hook and run on the Node adapter are exposed, since the crash happens when reroute rewrites a malformed path. Apps on static export or other adapters, or without a reroute hook, are not affected by this report. Apps that upgrade to the fixed versions are protected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["kit"],"ptokens":["kit","sveltejs"],"labels":["adapternode","cwe248","medium","node","npm","package","selfhosted","sveltekit"],"campaign_type":null,"search_a":"'2fmv':16A,21A 'adapt':11A 'adapter-nod':10A 'crash':9A 'ghsa':14A,19A 'ghsa-mw6w-2fmv-pvw3':13A,18A 'malform':7A 'mw6w':15A,20A 'node':12A 'pathnam':8A 'pvw3':17A,22A 'rerout':4A 'rewrit':5A 'sveltejs/kit':23A 'unhandl':1A 'urierror':2A","search_b":"'-248':28B 'adapt':25B,61B 'adapter-nod':24B,60B 'attack':64B 'built':58B 'caus':75B 'crash':54B 'cwe':27B 'denial':77B 'encod':44B 'hook':38B 'host':33B 'invalid':41B 'node':26B,29B,62B 'one':49B 'packag':30B 'path':45B 'percent':43B 'percent-encod':42B 'request':69B 'rerout':37B 'self':32B 'self-host':31B 'send':66B 'server':57B,73B 'servic':79B 'sveltekit':34B,56B 'take':71B 'turn':39B 'unhandl':51B 'urierror':52B 'valid':48B","search_c":"'comparison':98C 'could':94C 'crash':101C 'encod':87C 'invalid':84C 'path':88C,92C 'percent':86C 'percent-encod':85C 'potenti':95C 'rerout':81C 'server':103C 'trigger':96C 'turn':82C 'valid':91C 'would':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T23:47:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-mw6w-2fmv-pvw3","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-mw6w-2fmv-pvw3","severity":"medium","published_at":"2026-10-29T23:47:35+00:00","modified_at":"2026-10-29T23:47:35+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","fetched_at":"2026-11-09T22:53:15+00:00","note":null}],"documents":[{"id":110418,"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-mw6w-2fmv-pvw3","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}