CVE-2026-128122
Received Received - Intake

Prerendering Redirect Path Manipulation in SvelteKit

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 4.7.0 until versions 7.2.10 and 8.0.2, @sveltejs/adapter-cloudflare allowed an attacker-influenced link crawled during prerendering to place whitespace, control characters, wildcards, or placeholders into a prerendered redirect path. The adapter wrote those paths into the Cloudflare _redirects output without output-context validation, allowing a path to create unintended routing rules that could redirect or expose requests beyond the intended prerendered route. This issue is fixed in 7.2.10 and 8.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128122
EUVD
EUVD-2026-125767

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sveltejs adapter-cloudflare to 8.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SvelteKit versions between 4.7.0 and 7.2.9 or 8.0.1. The @sveltejs/adapter-cloudflare package allowed attackers to inject whitespace, control characters, wildcards, or placeholders into prerendered redirect paths during crawling. These manipulated paths were written directly into Cloudflare's _redirects file without proper validation, creating unintended routing rules that could redirect or expose requests outside the intended prerendered route.

Detection Guidance

Check if your SvelteKit project uses @sveltejs/adapter-cloudflare versions between 4.7.0 and 7.2.9 or 8.0.1. Inspect the _redirects file for unexpected paths containing whitespace, control characters, wildcards, or placeholders. Review prerendered routes for unintended redirects.

Impact Analysis

An attacker could exploit this to redirect users to malicious sites, expose sensitive internal routes, or bypass intended access controls. This could lead to phishing attacks, data leaks, or unauthorized access to restricted content. The impact depends on the application's prerendered routes and how redirects are configured.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or redirection, potentially violating GDPR's data protection requirements or HIPAA's access controls. If user data is redirected to untrusted destinations, it may constitute a breach of confidentiality obligations under these regulations.

Mitigation Strategies

Upgrade @sveltejs/adapter-cloudflare to version 7.2.10 or 8.0.2 or later. Regenerate prerendered files and verify the _redirects file contains only intended rules. Remove any suspicious paths or wildcards from redirects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...