{"affected":[{"product":"kit","source":"CNA: GitHub_M","vendor":"sveltejs","versions":[{"status":"affected","version":"< 2.70.4"},{"status":"affected","version":">= 3.0.0, < 3.1.1"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@sveltejs/kit","product":"@sveltejs/kit","source":"OSV GHSA-mw6w-2fmv-pvw3","vendor":"","versions":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.1.1"}],"lessThan":"3.1.1","status":"affected","version":"3.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@sveltejs/kit","product":"@sveltejs/kit","source":"OSV GHSA-mw6w-2fmv-pvw3","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"2.70.4"}],"lessThan":"2.70.4","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-128117","cwes":["CWE-248"],"description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, the reroute hook could rewrite an invalid percent-encoded pathname into a valid route and reach a comparison that decoded the original malformed pathname outside the guarded decoding operation. The resulting unhandled URIError could crash an adapter-node server and deny service to other requests. This issue is fixed in 2.70.4 and 3.1.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794604930163,"publishedAt":1794598144744,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-mw6w-2fmv-pvw3"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/pull/17620"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/commit/7993d5ebab017cb1be898a0b1c57371c5da06557"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-mw6w-2fmv-pvw3"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-mw6w-2fmv-pvw3"}],"remediation":[{"kind":"fix","source":"OSV GHSA-mw6w-2fmv-pvw3","text":"@sveltejs/kit (npm): OSV reports a fixed version 3.1.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-mw6w-2fmv-pvw3"},{"kind":"fix","source":"OSV GHSA-mw6w-2fmv-pvw3","text":"@sveltejs/kit (npm): OSV reports a fixed version 2.70.4. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-mw6w-2fmv-pvw3"}],"revision":"1641edb21c4e8b76338f771ff86e385f94f8342e1f6dc161c9bdcf9d66e1544d","sources":[{"modifiedAt":1794604930163,"name":"CNA: GitHub_M","retrievedAt":1794607764219,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128117"},{"modifiedAt":1794603603987,"name":"OSV / GitHub Security Advisories","retrievedAt":1794607764604,"url":"https://osv.dev/vulnerability/GHSA-mw6w-2fmv-pvw3"}],"ssvc":{"assessedAt":1794604922715,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"SvelteKit: Unhandled URIError when `reroute` rewrites a malformed pathname crashes adapter-node","updatedAt":1794607764604}