CVE-2026-128122: SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`
If an attacker can influence the links crawled during prerendering, they can influence the redirects entries that are added to the Cloudflare platform redirects generated during the adapt phase of the build.
References
- github.com/advisories/GHSA-5wg4-q3ww-283h
- github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd
- github.com/sveltejs/kit/commit/679e0d84ea9951bb4f1e458a599066b5a451b08a
- github.com/sveltejs/kit/pull/17620
- github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-cloudflare@7.2.10
- github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-cloudflare@8.0.2
- github.com/sveltejs/kit/security/advisories/GHSA-5wg4-q3ww-283h
- nvd.nist.gov/vuln/detail/CVE-2026-128122
Code Behaviors & Features
Detect and mitigate CVE-2026-128122 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →