6.9
Medium
CVE-2026-114062 SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach…
Description
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| kit 3.0 | earliest → < 3.0.0 | 3.0.0 |
Other CVEs of kit
The 22 CVEs of kit →
CVE-2026-114063
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on…
8.7
High
CVE-2026-114061
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a…
2.3
Low
CVE-2026-114060
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on…
2.1
Low
CVE-2026-82261
SvelteKit (@sveltejs/kit) versions >=2.49.0…
8.7
High