sveltejs-kit

### Impact Applications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS). SvelteKit inserts the header value into a `<meta http-equiv="cache-control">` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page. ### Patches The fix escapes the header value before inserting it into the generated HTML. Upgrade to `@svel

CVE: CVE-2026-114061

### Impact Applications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, such as catch-all routes, may be vulnerable to an open redirect. ### Patches A fix has been prepared for `@sveltejs/kit` 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page. ### Workarounds Reject requests whose parsed URL pathname begins with

CVE: CVE-2026-114060

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27mw-82g8-phjj. This link is maintained to preserve external references. ## Original Description SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the pa

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pfhg-q3qv-9q6r. This link is maintained to preserve external references. ## Original Description SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.

### Impact SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted `Accept` headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible. ### Patches The vulnerability is patched in `@sveltejs/kit` version 2.70.2.

CVE: CVE-2026-66062

If you use remote form functions, have an input field of type `file`, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype.

CVE: CVE-2026-82257

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.

CVE: CVE-2026-82256

`query.batch()` could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.

CVE: CVE-2026-82258

Under certain circumstances, requests could bypass the `BODY_SIZE_LIMIT` on SvelteKit applications running with `adapter-node`. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.

CVE: CVE-2026-40073

`redirect`, when called from inside the `handle` server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled `TypeError`. This could result in DoS on some platforms, especially if the location passed to `redirect` contains unsanitized user input.

CVE: CVE-2026-40074