A bug in SvelteKit’s handle server hook allows an unhandled TypeError when the redirect helper is called with a location string that contains characters invalid for an HTTP header. This error terminates the request processing and can disable the application on affected platforms, resulting in a denial of service. The flaw stems from inadequate validation of user‑supplied input that is passed to redirect, making the application vulnerable to formatted header attacks. The underlying weakness is identified as CWE‑755, a usability error where a default behaviour causes unintended effects.

The vulnerability affects all installations of the SvelteKit framework before version 2.57.1. Users running sveltejs:kit with any earlier release are at risk. The impact applies to the entire application runtime, as the unhandled exception can bring services down if not properly isolated.

The CVSS score of 6.3 indicates a medium severity. An attacker can exploit the flaw by sending an HTTP request that reaches the handle hook and includes a crafted location value with invalid header characters. The attack vector is likely remote, as the trigger occurs during normal request handling. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. However, the potential for service disruption warrants prompt action.