Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-114062

SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

sveltejs kit

Default version status: unaffected

  • 0 to < 3.0.0affected
  • 3.0.0unaffected
pkg:npm/%40sveltejs/kit

References