JEDI-SEC | Security Research & Digital Defense

GHSA-jf9x-2fg2-hx4w: SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static

Written by

jedisec_u136k7

in

  • Severity: MEDIUM
  • CVE: CVE-2026-128121
  • Ecosystems: npm, npm, npm, npm
  • Packages: @sveltejs/adapter-vercel, @sveltejs/adapter-static, @sveltejs/adapter-vercel, @sveltejs/adapter-static

If an attacker could influence a link that was crawled during the prerender phase, that link could later be interpreted as a regex in the Vercel routing configuration.

Source: GitHub Security Advisories · 2026-11-13

More posts