GHSA-mw6w-2fmv-pvw3MediumCVSS 5.9
SvelteKit: adapter-node crashes with an unhandled URIError when `reroute` rewrites malformed pathnames
🔗 CVE IDs covered (1)
📋 Description
When reroute turned an invalid percent-encoded path into a valid path, it could potentially trigger a comparison that would crash the server.
🎯 Affected products2
- npm/@sveltejs/kit:>= 3.0.0, < 3.1.1
- npm/@sveltejs/kit:< 2.70.4
🔗 References (7)
- https://github.com/sveltejs/kit/security/advisories/GHSA-mw6w-2fmv-pvw3
- https://github.com/sveltejs/kit/pull/17620
- https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd
- https://github.com/sveltejs/kit/commit/7993d5ebab017cb1be898a0b1c57371c5da06557
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]
- https://github.com/advisories/GHSA-mw6w-2fmv-pvw3