6.9
Moyenne
CVE-2026-114062 SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach…
Description
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| kit 3.0 | premières → < 3.0.0 | 3.0.0 |
Références
Chronologie
- Publiée
- Dernière modification
Autres CVE de kit
Les 22 CVE de kit →
CVE-2026-114063
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on…
8.7
Élevée
CVE-2026-114061
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a…
2.3
Faible
CVE-2026-114060
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on…
2.1
Faible
CVE-2026-82261
SvelteKit (@sveltejs/kit) versions >=2.49.0…
8.7
Élevée