Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, the reroute hook could rewrite an invalid percent-encoded pathname into a valid route and reach a comparison that decoded the original malformed pathname outside the guarded decoding operation. The resulting unhandled URIError could crash an adapter-node server and deny service to other requests. This issue is fixed in 2.70.4 and 3.1.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sveltejs | kit | < 2.70.4, >= 3.0.0, < 3.1.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @sveltejs/kit | >= 3.0.0, < 3.1.1 | 3.1.1 | GHSA-mw6w-2fmv-pvw3 |
| npm | @sveltejs/kit | < 2.70.4 | 2.70.4 | GHSA-mw6w-2fmv-pvw3 |
References
- https://github.com/sveltejs/kit/security/advisories/GHSA-mw6w-2fmv-pvw3
- https://github.com/sveltejs/kit/pull/17620
- https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd
- https://github.com/sveltejs/kit/commit/7993d5ebab017cb1be898a0b1c57371c5da06557
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.4
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1