{"affected":[{"product":"kit","source":"CNA: GitHub_M","vendor":"sveltejs","versions":[{"status":"affected","version":"< 2.70.4"},{"status":"affected","version":">= 3.0.0-next.0, < 3.1.1"}]},{"product":"adapter-vercel","source":"CNA: GitHub_M","vendor":"@sveltejs","versions":[{"status":"affected","version":"< 6.3.5"},{"status":"affected","version":">= 7.0.0-next.0, < 7.0.2"}]},{"product":"adapter-static","source":"CNA: GitHub_M","vendor":"@sveltejs","versions":[{"status":"affected","version":"< 3.0.11"},{"status":"affected","version":">= 4.0.0-next.0, < 4.0.1"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@sveltejs/adapter-vercel","product":"@sveltejs/adapter-vercel","source":"OSV GHSA-jf9x-2fg2-hx4w","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"6.3.5"}],"lessThan":"6.3.5","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@sveltejs/adapter-static","product":"@sveltejs/adapter-static","source":"OSV GHSA-jf9x-2fg2-hx4w","vendor":"","versions":[{"events":[{"introduced":"4.0.0-next.0"},{"fixed":"4.0.1"}],"lessThan":"4.0.1","status":"affected","version":"4.0.0-next.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@sveltejs/adapter-vercel","product":"@sveltejs/adapter-vercel","source":"OSV GHSA-jf9x-2fg2-hx4w","vendor":"","versions":[{"events":[{"introduced":"7.0.0-next.0"},{"fixed":"7.0.2"}],"lessThan":"7.0.2","status":"affected","version":"7.0.0-next.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@sveltejs/adapter-static","product":"@sveltejs/adapter-static","source":"OSV GHSA-jf9x-2fg2-hx4w","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"3.0.11"}],"lessThan":"3.0.11","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-128121","cwes":["CWE-116","CWE-625"],"description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5  and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be emitted into the generated Vercel routing configuration without escaping regular-expression metacharacters. The configuration could consequently interpret the path as regular-expression syntax, match unintended application paths, and expose content or behavior outside the intended path. This issue is fixed in @sveltejs/adapter-vercel 6.3.5  and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794604974622,"publishedAt":1794599059075,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-jf9x-2fg2-hx4w"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/pull/17620"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/commit/2ed61a6aa3ac230b89e3528654c587847d1525a0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-static@3.0.11"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-static@4.0.1"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-vercel@6.3.5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-vercel@7.0.2"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-jf9x-2fg2-hx4w"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-jf9x-2fg2-hx4w"}],"remediation":[{"kind":"fix","source":"OSV GHSA-jf9x-2fg2-hx4w","text":"@sveltejs/adapter-vercel (npm): OSV reports a fixed version 6.3.5. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-jf9x-2fg2-hx4w"},{"kind":"fix","source":"OSV GHSA-jf9x-2fg2-hx4w","text":"@sveltejs/adapter-static (npm): OSV reports a fixed version 4.0.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-jf9x-2fg2-hx4w"},{"kind":"fix","source":"OSV GHSA-jf9x-2fg2-hx4w","text":"@sveltejs/adapter-vercel (npm): OSV reports a fixed version 7.0.2. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-jf9x-2fg2-hx4w"},{"kind":"fix","source":"OSV GHSA-jf9x-2fg2-hx4w","text":"@sveltejs/adapter-static (npm): OSV reports a fixed version 3.0.11. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-jf9x-2fg2-hx4w"}],"revision":"e2f80accaba3e98d0c91f0d425ef3c6cd4d3f93b07f8e2bdfa401e13f23ead39","sources":[{"modifiedAt":1794604974622,"name":"CNA: GitHub_M","retrievedAt":1794607765643,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128121"},{"modifiedAt":1794603603964,"name":"OSV / GitHub Security Advisories","retrievedAt":1794607766123,"url":"https://osv.dev/vulnerability/GHSA-jf9x-2fg2-hx4w"}],"ssvc":{"assessedAt":1794604961259,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static","updatedAt":1794607766123}