CVE-2026-114062

SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks

State: Published
Severity: 6.9 Medium
Published: Oct 21, 2026
Updated: Oct 22, 2026
Reserved: Oct 20, 2026

Description

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
kitsveltejs	before 3.0.0Affected 3.0.0Not affected

References

GitHub Security Advisory (GHSA-prjg-x2qj-wj3g)vendor-advisory
VulnCheck Advisory: SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacksthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.