CVE-2026-128121
Received Received - Intake

Path Traversal in SvelteKit Adapter for Vercel

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be emitted into the generated Vercel routing configuration without escaping regular-expression metacharacters. The configuration could consequently interpret the path as regular-expression syntax, match unintended application paths, and expose content or behavior outside the intended path. This issue is fixed in @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128121
EUVD
EUVD-2026-125766

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sveltejs adapter-vercel From 7.0.2 (inc) to 6.3.5 (exc)
sveltejs adapter-static From 4.0.1 (inc) to 3.0.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-625 The product uses a regular expression that does not sufficiently restrict the set of allowed values.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SvelteKit applications using specific adapters. An attacker can craft a malicious link that, when crawled during prerendering, gets included in the Vercel routing configuration without proper escaping of regular-expression metacharacters. This causes the configuration to interpret the path as regex syntax, potentially matching unintended application paths and exposing content or behavior outside the intended scope.

Detection Guidance

This vulnerability is specific to SvelteKit applications using vulnerable versions of @sveltejs/adapter-vercel or @sveltejs/adapter-static. Detection requires checking the installed versions of these adapters in your project. Run commands like 'npm list @sveltejs/adapter-vercel' or 'npm list @sveltejs/adapter-static' to identify vulnerable versions.

Impact Analysis

An attacker could exploit this to access sensitive data or functionality not meant to be public. For example, they might bypass intended path restrictions and retrieve files or API responses they shouldn't have access to. This could lead to data leaks or unauthorized actions depending on the application's structure.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. If sensitive data is leaked due to this flaw, organizations may face compliance violations, legal penalties, or reputational damage depending on the data involved.

Mitigation Strategies

Immediately update @sveltejs/adapter-vercel to version 6.3.5 or later, or 7.0.2 or later. For @sveltejs/adapter-static, update to version 3.0.11 or later, or 4.0.1 or later. Verify the updates in your project dependencies and redeploy the application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128121. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...