CVE-2026-114062

MEDIUM 5.3

SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.

CWE	CWE-918
Vendor	sveltejs
Product	kit
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for sveltejs kit

Be the first to know when new medium vulnerabilities affecting sveltejs kit are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

sveltejs / kit

0 < 3.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/sveltejs/kit/security/advisories/GHSA-prjg-x2qj-wj3g vulncheck.com: https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-ssrf-via-redirects-in-server-side-self-fetch-fallbacks

Credits

Rich-Harris