Kit EUVD-2026-21504

The CVSS 4.0 score of 6.3 reflects a network-accessible vulnerability with low attack complexity and no privileges required, but with partial availability impact (SA:L). The attack tree parameter AT:P suggests some attack obstacles exist, likely the need to influence application logic to reach the vulnerable code path. The EPSS score is not provided, but real-world exploitation probability is moderate given that the attack requires the redirect() function to be called from the handle hook with attacker-controlled input-a pattern that may exist in many web applications but is not universal. While no CISA KEV confirmation is present in the data, the vulnerability is actionable and straightforward to exploit if the vulnerable code pattern exists. The primary risk is application availability via DoS rather than confidentiality or integrity breach. Remediation is straightforward (upgrade to 2.57.1), making this a medium-priority item for SvelteKit deployments that use server-side redirects with untrusted input.

An attacker identifies a SvelteKit application that uses server-side redirects within the handle hook and accepts user input (e.g., via query parameters or POST data) that flows to the redirect location. The attacker crafts a malicious request with a location parameter containing newline characters or other HTTP-header-invalid sequences. When the application's handle hook processes this request and calls redirect() with the malicious input, the unhandled TypeError crashes the request handler, resulting in a denial of service. No complex authentication is required; the attack succeeds through a simple HTTP request with crafted input. No public exploit code is referenced in the available data, but the vulnerability is trivial to exploit once a vulnerable code pattern is identified.