CVE-2026-128123: 
JavaScript vulnerability analysis and mitigation

CVE-2026-128123 is a Denial of Service vulnerability in @sveltejs/adapter-node, a Node.js deployment adapter for the SvelteKit web framework. When handling text/event-stream (Server-Sent Events) responses proxied via fetch, the adapter attempts to set the X-Accel-Buffering header on an immutable Response object, triggering an uncaught exception that crashes the server and denies service to all subsequent requests. Affected versions include @sveltejs/adapter-node >= 5.5.7 and < 5.5.8, >= 6.0.0-next.0 and < 6.0.1, and @sveltejs/kit < 2.70.4 and >= 3.0.0-next.0 and < 3.1.1. The vulnerability was disclosed on November 13, 2026, with a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-248 (Uncaught Exception). In packages/adapter-node/src/handler.js, the server-side request handler (SSR handler) detects text/event-stream content-type responses and attempts to call response.headers.set('x-accel-buffering', 'no') to disable proxy buffering. However, when the response is returned from a fetch() call (e.g., proxying an upstream SSE endpoint), the Response object's headers are immutable per the Fetch API specification, causing a TypeError to be thrown. This exception is not caught, propagating up and crashing the Node.js server process. The fix moves the header assignment to the underlying Node.js res.setHeader() call instead, bypassing the immutable Response headers entirely (GitHub Advisory, Fix Commit).

Successful exploitation results in a complete availability loss for the affected server instance — all requests routed to that server are denied after the crash. There is no confidentiality or integrity impact; the vulnerability is purely a Denial of Service condition. An unauthenticated remote attacker can trigger this crash by sending a crafted request that causes the server to proxy a text/event-stream response via fetch, rendering the service unavailable to all users until the server is restarted (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity (AC:H), as the attacker must be able to trigger a server-side fetch of a text/event-stream resource in a context where the response headers are immutable (GitHub Advisory).

1. Reconnaissance: Identify a target SvelteKit application deployed with @sveltejs/adapter-node version 5.5.7 or a 6.0.0 pre-release prior to 6.0.1, or @sveltejs/kit < 2.70.4 / 3.0.0-next.0 to < 3.1.1.
2. Identify SSE proxy endpoint: Locate or infer a server route that proxies a text/event-stream response using fetch() (e.g., a route that returns return fetch('...') where the upstream returns Content-Type: text/event-stream).
3. Send crafted request: Issue an HTTP GET request to the identified SSE proxy endpoint (e.g., /event-stream/proxied), causing the server to execute the fetch-based proxy logic.
4. Trigger crash: The adapter's SSR handler detects the text/event-stream content type and attempts response.headers.set('x-accel-buffering', 'no') on the immutable fetch Response object, throwing an uncaught TypeError that crashes the server process.
5. Denial of Service achieved: All subsequent requests to the server instance fail until the process is restarted, achieving a full denial of service (GitHub Advisory, Fix Commit).

• Logs: Node.js process logs showing an uncaught TypeError such as TypeError: Cannot set property of immutable Headers originating from handler.js in the @sveltejs/adapter-node package; sudden absence of access log entries following the error (indicating server crash).
• Process: Unexpected termination or restart of the SvelteKit/Node.js server process; process managers (e.g., PM2, systemd) logging unexpected restarts of the application service.
• Network: Repeated HTTP requests to SSE proxy endpoints (e.g., routes returning text/event-stream content proxied via fetch) from the same or multiple source IPs, followed by connection refused errors from the server.

Upgrade @sveltejs/adapter-node to version 5.5.8 or 6.0.1 (or later), and @sveltejs/kit to version 2.70.4 (for the 2.x branch) or 3.1.1 (for the 3.x branch). No configuration-based workaround is available; patching is the only remediation. The fix was backported to the version-2 branch via PR #17620 and released on November 5, 2026 (GitHub Advisory, Release 5.5.8, Backport PR).

The vulnerability was reported by researcher timhaines and remediated by SvelteKit maintainer Rich-Harris, with the advisory published by elliott-with-the-longest-name-on-github. The issue received standard automated coverage from vulnerability tracking services (CVEFeed, VulDB, CIRCL) shortly after disclosure. Social media activity was minimal, with brief automated posts on Mastodon (infosec.exchange) and Bluesky (GitHub Advisory).