GHSA-mw6w-2fmv-pvw3: SvelteKit: adapter-node crashes with an unhandled URIError when `reroute` rewrites malformed pathnames

• Severity: MEDIUM
• CVE: CVE-2026-128117
• Ecosystems: npm, npm
• Packages: @sveltejs/kit, @sveltejs/kit

When `reroute` turned an invalid percent-encoded path into a valid path, it could potentially trigger a comparison that would crash the server.

Source: GitHub Security Advisories · 2026-11-13