CVE-2026-40074

OVERVIEW CVE-2026-40074 is a denial-of-service vulnerability in SvelteKit versions prior to 2.57.1, a popular web application framework built on Svelte. The flaw occurs when the redirect function is called from within the handle server hook with a location parameter containing invalid HTTP header characters, causing an unhandled TypeError. If unsanitized user input is passed to the redirect function, attackers can trigger this condition. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. Attack complexity is low, making exploitation straightforward for remote threat actors. The impact is limited to service availability, with no confidentiality or integrity implications. The attack can result in denial-of-service conditions on affected platforms, disrupting application functionality. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog, and community attention remains minimal as reflected in the low EPSS score of 0.00052. No public exploit code has been identified. Organizations running vulnerable versions should prioritize patching to version 2.57.1 as a standard maintenance item rather than an emergency response.