{"id":"CVE-2026-128122","summary":"SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`","details":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 4.7.0 until versions 7.2.10 and 8.0.2, @sveltejs/adapter-cloudflare allowed an attacker-influenced link crawled during prerendering to place whitespace, control characters, wildcards, or placeholders into a prerendered redirect path. The adapter wrote those paths into the Cloudflare _redirects output without output-context validation, allowing a path to create unintended routing rules that could redirect or expose requests beyond the intended prerendered route. This issue is fixed in 7.2.10 and 8.0.2.","aliases":["GHSA-5wg4-q3ww-283h"],"modified":"2026-11-14T10:45:36.747896517Z","published":"2026-11-13T19:47:28.720Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-116","CWE-79","CWE-93"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128122.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128122.json"},{"type":"FIX","url":"https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd"},{"type":"FIX","url":"https://github.com/sveltejs/kit/commit/679e0d84ea9951bb4f1e458a599066b5a451b08a"},{"type":"FIX","url":"https://github.com/sveltejs/kit/pull/17620"},{"type":"WEB","url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-cloudflare@7.2.10"},{"type":"WEB","url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-cloudflare@8.0.2"},{"type":"ADVISORY","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-5wg4-q3ww-283h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128122"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sveltejs/kit","events":[{"introduced":"e9c84a0bb1edf4f4a8f47827ea26458216811789"},{"fixed":"70a5ad21c58266d3e08863b519d9485819b1a776"},{"introduced":"a77f5e9a515ff2cb14dece7ed2b0b8ad9e370b2f"},{"fixed":"04aac59bad580f01ad08627e464c24f9f74401fe"},{"fixed":"0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd"},{"fixed":"679e0d84ea9951bb4f1e458a599066b5a451b08a"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"4.7.0"},{"fixed":"7.2.10"}]},{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"8.0.0-next.0"},{"fixed":"8.0.2"}]},{"range":[{"fixed":"0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"679e0d84ea9951bb4f1e458a599066b5a451b08a"}]}]}}],"versions":["@sveltejs/package@3.0.1","@sveltejs/kit@3.1.0","@sveltejs/adapter-vercel@7.0.1","@sveltejs/adapter-cloudflare@8.0.1","@sveltejs/kit@3.0.1","@sveltejs/adapter-netlify@7.0.1","@sveltejs/package@3.0.0","@sveltejs/kit@3.0.0","@sveltejs/enhanced-img@1.0.0","@sveltejs/adapter-vercel@7.0.0","@sveltejs/adapter-static@4.0.0","@sveltejs/adapter-node@6.0.0","@sveltejs/adapter-netlify@7.0.0","@sveltejs/adapter-cloudflare@8.0.0","@sveltejs/adapter-bun@1.0.0","@sveltejs/adapter-auto@8.0.0","@sveltejs/kit@2.70.3","@sveltejs/kit@2.70.2","@sveltejs/kit@2.70.1","@sveltejs/kit@2.70.0","@sveltejs/kit@2.69.3","@sveltejs/kit@2.69.2","@sveltejs/kit@2.69.1","@sveltejs/kit@2.69.0","@sveltejs/kit@2.68.0","@sveltejs/adapter-node@5.5.7","@sveltejs/kit@2.67.0","@sveltejs/adapter-node@5.5.6","@sveltejs/kit@2.66.0","@sveltejs/enhanced-img@0.11.0","@sveltejs/adapter-vercel@6.3.4","@sveltejs/adapter-node@5.5.5","@sveltejs/kit@2.65.2","@sveltejs/adapter-cloudflare@7.2.9","@sveltejs/kit@2.65.1","@sveltejs/kit@2.65.0","@sveltejs/kit@2.64.0","@sveltejs/kit@2.63.1","@sveltejs/kit@2.63.0","@sveltejs/package@2.5.8","@sveltejs/kit@2.62.0","@sveltejs/kit@2.61.1","@sveltejs/kit@2.61.0","@sveltejs/kit@2.60.1","@sveltejs/kit@2.60.0","@sveltejs/kit@2.59.1","@sveltejs/kit@2.59.0","@sveltejs/kit@2.58.0","@sveltejs/kit@2.57.1","@sveltejs/kit@2.57.0","@sveltejs/kit@2.56.1","@sveltejs/kit@2.56.0","@sveltejs/kit@2.55.0","@sveltejs/enhanced-img@0.10.4","@sveltejs/kit@2.54.0","@sveltejs/kit@2.53.4","@sveltejs/kit@2.53.3","@sveltejs/adapter-node@5.5.4","@sveltejs/kit@2.53.2","@sveltejs/kit@2.53.1","@sveltejs/adapter-vercel@6.3.3","@sveltejs/adapter-netlify@6.0.4","@sveltejs/adapter-netlify@6.0.3","@sveltejs/kit@2.53.0","@sveltejs/enhanced-img@0.10.3","@sveltejs/kit@2.52.2","@sveltejs/adapter-vercel@6.3.2","@sveltejs/adapter-netlify@6.0.2","@sveltejs/adapter-cloudflare@7.2.8","@sveltejs/kit@2.52.0","@sveltejs/adapter-auto@7.0.1","@sveltejs/enhanced-img@0.10.2","@sveltejs/kit@2.51.0","@sveltejs/enhanced-img@0.10.1","@sveltejs/adapter-node@5.5.3","@sveltejs/adapter-netlify@6.0.0","@sveltejs/adapter-cloudflare@7.2.7","@sveltejs/kit@2.50.2","@sveltejs/enhanced-img@0.10.0","@sveltejs/kit@2.50.1","@sveltejs/adapter-vercel@6.3.1","@sveltejs/adapter-node@5.5.2","@sveltejs/adapter-cloudflare@7.2.6","@sveltejs/kit@2.50.0","@sveltejs/enhanced-img@0.9.3","@sveltejs/kit@2.49.5","@sveltejs/adapter-node@5.5.1","@sveltejs/adapter-cloudflare@7.2.5","@sveltejs/adapter-node@5.5.0","@sveltejs/kit@2.49.4","@sveltejs/kit@2.49.3","@sveltejs/adapter-vercel@6.3.0","@sveltejs/kit@2.49.2","@sveltejs/kit@2.49.1","@sveltejs/package@2.5.7","@sveltejs/enhanced-img@0.9.2","@sveltejs/adapter-vercel@6.2.0","@sveltejs/enhanced-img@0.9.1","@sveltejs/kit@2.49.0","@sveltejs/kit@2.48.8","@sveltejs/enhanced-img@0.9.0","@sveltejs/package@2.5.6","@sveltejs/kit@2.48.7","@sveltejs/adapter-vercel@6.1.2","@sveltejs/package@2.5.5","@sveltejs/kit@2.48.6","@sveltejs/kit@2.48.5","@sveltejs/enhanced-img@0.8.5","@sveltejs/kit@2.48.4","@sveltejs/kit@2.48.3","@sveltejs/adapter-vercel@6.1.1","@sveltejs/kit@2.48.2","@sveltejs/kit@2.48.1","@sveltejs/adapter-vercel@6.1.0","@sveltejs/kit@2.48.0","@sveltejs/kit@2.47.3","@sveltejs/kit@2.47.2","@sveltejs/kit@2.47.1","@sveltejs/adapter-auto@7.0.0","@sveltejs/kit@2.47.0","@sveltejs/adapter-vercel@6.0.0","@sveltejs/adapter-node@5.4.0","@sveltejs/kit@2.46.5","@sveltejs/kit@2.46.4","@sveltejs/kit@2.46.3","@sveltejs/kit@2.46.2","@sveltejs/kit@2.46.1","@sveltejs/kit@2.46.0","@sveltejs/kit@2.45.0","@sveltejs/kit@2.44.0","@sveltejs/enhanced-img@0.8.4","@sveltejs/kit@2.43.8","@sveltejs/enhanced-img@0.8.3","@sveltejs/adapter-vercel@5.10.3","@sveltejs/adapter-static@3.0.10","@sveltejs/adapter-node@5.3.3","@sveltejs/adapter-netlify@5.2.4","@sveltejs/adapter-cloudflare@7.2.4","@sveltejs/adapter-auto@6.1.1","@sveltejs/kit@2.43.7","@sveltejs/kit@2.43.6","@sveltejs/kit@2.43.5","@sveltejs/kit@2.43.4","@sveltejs/kit@2.43.3","@sveltejs/enhanced-img@0.8.2","@sveltejs/package@2.5.4","@sveltejs/kit@2.43.2","@sveltejs/kit@2.43.1","@sveltejs/kit@2.43.0","@sveltejs/package@2.5.3","@sveltejs/kit@2.42.2","@sveltejs/kit@2.42.1","@sveltejs/kit@2.42.0","@sveltejs/kit@2.41.0","@sveltejs/package@2.5.2","@sveltejs/kit@2.40.0","@sveltejs/package@2.5.1","@sveltejs/kit@2.39.1","@sveltejs/kit@2.39.0","@sveltejs/kit@2.38.1","@sveltejs/kit@2.38.0","@sveltejs/adapter-node@5.3.2","@sveltejs/kit@2.37.1","@sveltejs/kit@2.37.0","@sveltejs/kit@2.36.3","@sveltejs/adapter-netlify@5.2.3","@sveltejs/adapter-cloudflare@7.2.3","@sveltejs/kit@2.36.2","@sveltejs/kit@2.36.1","@sveltejs/kit@2.36.0","@sveltejs/package@2.5.0","@sveltejs/kit@2.35.0","@sveltejs/kit@2.34.1","@sveltejs/adapter-cloudflare@7.2.2","@sveltejs/kit@2.34.0","@sveltejs/kit@2.33.1","@sveltejs/adapter-vercel@5.10.2","@sveltejs/adapter-netlify@5.2.2","@sveltejs/adapter-vercel@5.10.1","@sveltejs/kit@2.33.0","@sveltejs/kit@2.32.0","@sveltejs/enhanced-img@0.8.1","@sveltejs/adapter-vercel@5.10.0","@sveltejs/kit@2.31.1","@sveltejs/adapter-vercel@5.9.1","@sveltejs/adapter-node@5.3.1","@sveltejs/adapter-netlify@5.2.1","@sveltejs/adapter-cloudflare@7.2.1","@sveltejs/kit@2.31.0","@sveltejs/adapter-vercel@5.9.0","@sveltejs/adapter-node@5.3.0","@sveltejs/adapter-netlify@5.2.0","@sveltejs/adapter-cloudflare@7.2.0","@sveltejs/kit@2.30.1","@sveltejs/adapter-node@5.2.16","@sveltejs/kit@2.30.0","@sveltejs/adapter-node@5.2.15","@sveltejs/kit@2.29.1","@sveltejs/kit@2.29.0","@sveltejs/kit@2.28.0","@sveltejs/enhanced-img@0.8.0","@sveltejs/adapter-auto@6.1.0","create-svelte@7.0.1","@sveltejs/package@2.4.1","@sveltejs/kit@2.27.3","@sveltejs/enhanced-img@0.7.1","@sveltejs/amp@1.1.5","@sveltejs/adapter-vercel@5.8.2","@sveltejs/adapter-static@3.0.9","@sveltejs/adapter-node@5.2.14","@sveltejs/adapter-netlify@5.1.1","@sveltejs/adapter-cloudflare@7.1.3","@sveltejs/adapter-auto@6.0.2","@sveltejs/kit@2.27.2","@sveltejs/kit@2.27.1","@sveltejs/kit@2.27.0","@sveltejs/adapter-cloudflare@7.1.2","@sveltejs/kit@2.26.1","@sveltejs/adapter-vercel@5.8.1","@sveltejs/kit@2.26.0","@sveltejs/kit@2.25.2","@sveltejs/adapter-cloudflare@7.1.1","@sveltejs/kit@2.25.1","@sveltejs/kit@2.25.0","@sveltejs/adapter-vercel@5.8.0","@sveltejs/adapter-netlify@5.1.0","@sveltejs/adapter-cloudflare@7.1.0","@sveltejs/kit@2.24.0","@sveltejs/package@2.4.0","@sveltejs/kit@2.23.0","@sveltejs/enhanced-img@0.7.0","@sveltejs/kit@2.22.5","@sveltejs/kit@2.22.4","@sveltejs/kit@2.22.3","@sveltejs/adapter-node@5.2.13","@sveltejs/adapter-cloudflare@7.0.5","@sveltejs/kit@2.22.2","@sveltejs/package@2.3.12","@sveltejs/kit@2.22.1","@sveltejs/enhanced-img@0.6.1","@sveltejs/kit@2.22.0","@sveltejs/kit@2.21.5","@sveltejs/kit@2.21.4","@sveltejs/kit@2.21.3","@sveltejs/adapter-cloudflare@7.0.4","@sveltejs/kit@2.21.2","@sveltejs/kit@2.21.1","@sveltejs/kit@2.21.0","@sveltejs/enhanced-img@0.6.0","@sveltejs/adapter-auto@6.0.1","@sveltejs/enhanced-img@0.5.1","@sveltejs/adapter-vercel@5.7.2","@sveltejs/adapter-netlify@5.0.2","@sveltejs/adapter-cloudflare@7.0.3","@sveltejs/enhanced-img@0.5.0","@sveltejs/kit@2.20.8","@sveltejs/adapter-vercel@5.7.1","@sveltejs/adapter-netlify@5.0.1","@sveltejs/adapter-cloudflare@7.0.2","@sveltejs/kit@2.20.7","@sveltejs/kit@2.20.6","@sveltejs/package@2.3.11","@sveltejs/kit@2.20.5","@sveltejs/kit@2.20.4","@sveltejs/adapter-vercel@5.7.0","@sveltejs/adapter-cloudflare@7.0.1","@sveltejs/adapter-auto@6.0.0","@sveltejs/kit@2.20.3","@sveltejs/adapter-cloudflare@7.0.0","@sveltejs/adapter-cloudflare@6.0.1","@sveltejs/kit@2.20.2","@sveltejs/adapter-netlify@5.0.0","@sveltejs/adapter-cloudflare@6.0.0","@sveltejs/adapter-auto@5.0.0","@sveltejs/kit@2.20.1","@sveltejs/kit@2.20.0","@sveltejs/kit@2.19.2","@sveltejs/adapter-cloudflare@5.1.0","@sveltejs/adapter-cloudflare-workers@2.9.0","@sveltejs/kit@2.19.1","@sveltejs/kit@2.19.0","@sveltejs/kit@2.18.0","@sveltejs/kit@2.17.3","@sveltejs/adapter-netlify@4.4.2","@sveltejs/adapter-cloudflare-workers@2.8.0","@sveltejs/adapter-vercel@5.6.3","@sveltejs/kit@2.17.2","@sveltejs/adapter-vercel@5.6.2","@sveltejs/adapter-cloudflare@5.0.3","@sveltejs/kit@2.17.1","@sveltejs/adapter-vercel@5.6.1","@sveltejs/package@2.3.10","@sveltejs/kit@2.17.0","@sveltejs/adapter-vercel@5.6.0","@sveltejs/adapter-cloudflare@5.0.2","@sveltejs/adapter-cloudflare-workers@2.7.1","@sveltejs/package@2.3.9","@sveltejs/adapter-netlify@4.4.1","@sveltejs/package@2.3.8","@sveltejs/kit@2.16.1","@sveltejs/kit@2.16.0","@sveltejs/adapter-vercel@5.5.3","@sveltejs/adapter-node@5.2.12","@sveltejs/kit@2.15.3","@sveltejs/adapter-cloudflare@5.0.1","@sveltejs/adapter-auto@4.0.0","@sveltejs/kit@2.15.2","@sveltejs/kit@2.15.1","@sveltejs/adapter-cloudflare@5.0.0","@sveltejs/kit@2.15.0","@sveltejs/kit@2.14.1","@sveltejs/adapter-static@3.0.8","@sveltejs/adapter-static@3.0.7","@sveltejs/kit@2.14.0","@sveltejs/kit@2.13.0","@sveltejs/adapter-cloudflare@4.9.0","@sveltejs/kit@2.12.2","@sveltejs/adapter-node@5.2.11","@sveltejs/kit@2.12.1","@sveltejs/kit@2.12.0","@sveltejs/kit@2.11.1","@sveltejs/enhanced-img@0.4.4","@sveltejs/kit@2.11.0","@sveltejs/adapter-node@5.2.10","@sveltejs/adapter-cloudflare-workers@2.7.0","@sveltejs/kit@2.10.1","@sveltejs/kit@2.10.0","@sveltejs/adapter-vercel@5.5.2","@sveltejs/enhanced-img@0.4.3","@sveltejs/kit@2.9.1","@sveltejs/enhanced-img@0.4.2","@sveltejs/adapter-vercel@5.5.1","@sveltejs/kit@2.9.0","@sveltejs/adapter-vercel@5.5.0","@sveltejs/adapter-netlify@4.4.0","@sveltejs/adapter-cloudflare@4.8.0","@sveltejs/adapter-cloudflare-workers@2.6.0","@sveltejs/kit@2.8.4","@sveltejs/kit@2.8.5","@sveltejs/kit@2.8.3","@sveltejs/kit@2.8.2","@sveltejs/adapter-vercel@5.4.8","@sveltejs/kit@2.8.1","@sveltejs/kit@2.8.0","@sveltejs/adapter-vercel@5.4.7","@sveltejs/kit@2.7.7","@sveltejs/kit@2.7.6","@sveltejs/kit@2.7.5","@sveltejs/enhanced-img@0.4.1","svelte-migrate@1.6.8","svelte-migrate@1.6.7","@sveltejs/kit@2.7.4","@sveltejs/enhanced-img@0.4.0","svelte-migrate@1.6.6","@sveltejs/package@2.3.7","@sveltejs/kit@2.7.3","@sveltejs/enhanced-img@0.3.10","@sveltejs/amp@1.1.4","@sveltejs/adapter-vercel@5.4.6","@sveltejs/adapter-static@3.0.6","@sveltejs/adapter-node@5.2.9","@sveltejs/adapter-netlify@4.3.6","@sveltejs/adapter-cloudflare@4.7.4","@sveltejs/adapter-cloudflare-workers@2.5.6","@sveltejs/adapter-auto@3.3.1","create-svelte@7.0.0","svelte-migrate@1.6.4","@sveltejs/kit@2.7.2","svelte-migrate@1.6.3","@sveltejs/adapter-node@5.2.8","@sveltejs/kit@2.7.1","@sveltejs/adapter-node@5.2.7","create-svelte@6.4.0","@sveltejs/kit@2.7.0","@sveltejs/enhanced-img@0.3.9","@sveltejs/adapter-netlify@4.3.5","@sveltejs/adapter-cloudflare@4.7.3","@sveltejs/adapter-cloudflare-workers@2.5.5","@sveltejs/adapter-node@5.2.6","svelte-migrate@1.6.2","svelte-migrate@1.6.1","@sveltejs/kit@2.6.4","@sveltejs/kit@2.6.3","@sveltejs/adapter-vercel@5.4.5","svelte-migrate@1.6.0","@sveltejs/kit@2.6.2","svelte-migrate@1.5.1","svelte-migrate@1.5.0","@sveltejs/kit@2.6.1","create-svelte@6.3.12","@sveltejs/kit@2.6.0","@sveltejs/adapter-node@5.2.5","@sveltejs/adapter-node@5.2.4","create-svelte@6.3.11","@sveltejs/kit@2.5.28","@sveltejs/enhanced-img@0.3.8","@sveltejs/adapter-vercel@5.4.4","@sveltejs/adapter-static@3.0.5","@sveltejs/adapter-node@5.2.3","@sveltejs/adapter-netlify@4.3.4","@sveltejs/adapter-auto@3.2.5","@sveltejs/enhanced-img@0.3.7","@sveltejs/enhanced-img@0.3.6","@sveltejs/package@2.3.5","@sveltejs/kit@2.5.27","@sveltejs/enhanced-img@0.3.5","create-svelte@6.3.10","@sveltejs/kit@2.5.26","create-svelte@6.3.9","@sveltejs/kit@2.5.25","@sveltejs/enhanced-img@0.3.4","@sveltejs/kit@2.5.24","create-svelte@6.3.8","@sveltejs/kit@2.5.23","svelte-migrate@1.4.5","create-svelte@6.3.7","@sveltejs/package@2.3.4","@sveltejs/kit@2.5.22","@sveltejs/enhanced-img@0.3.3","@sveltejs/amp@1.1.3","@sveltejs/adapter-vercel@5.4.3","@sveltejs/adapter-static@3.0.4","@sveltejs/adapter-node@5.2.2","@sveltejs/adapter-netlify@4.3.3","@sveltejs/adapter-cloudflare@4.7.2","@sveltejs/adapter-cloudflare-workers@2.5.4","@sveltejs/adapter-auto@3.2.4","svelte-migrate@1.4.4","create-svelte@6.3.6","@sveltejs/package@2.3.3","@sveltejs/kit@2.5.21","@sveltejs/enhanced-img@0.3.2","@sveltejs/amp@1.1.2","@sveltejs/adapter-vercel@5.4.2","@sveltejs/adapter-static@3.0.3","@sveltejs/adapter-node@5.2.1","@sveltejs/adapter-netlify@4.3.2","@sveltejs/adapter-cloudflare@4.7.1","@sveltejs/adapter-cloudflare-workers@2.5.3","@sveltejs/adapter-auto@3.2.3","@sveltejs/kit@2.5.20","@sveltejs/kit@2.5.19","create-svelte@6.3.5","create-svelte@6.3.4","@sveltejs/enhanced-img@0.3.1","@sveltejs/adapter-cloudflare@4.7.0","@sveltejs/adapter-cloudflare-workers@2.5.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128122.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}