CVE-2026-114061: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
Impact
Applications that prerender pages and use setHeaders to set a cache-control header from an untrusted source are vulnerable to cross-site scripting (XSS).
SvelteKit inserts the header value into a <meta http-equiv="cache-control"> tag without escaping it. An attacker who can influence this value at prerender time can break out of the content attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.
Patches
The fix escapes the header value before inserting it into the generated HTML. Upgrade to @sveltejs/kit version 3.0.0 or later.
Workarounds
Avoid forwarding untrusted cache-control header values with setHeaders on prerendered pages. Use a fixed, trusted cache policy instead.
Other sources
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@sveltejs/kitto a version that resolves this vulnerability.Fixed in 3.0.0 - Upgrade
Upgrade
@sveltejs/kitto a version that resolves this vulnerability.Fixed in 3.0.0 - Configuration
Do not forward untrusted cache-control header values with setHeaders; use a fixed, trusted cache policy instead.
SvelteKit prerendered pages setHeaders cache-control = fixed, trusted cache policy
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using @sveltejs/kit versions before 3.0.0 are exposed if they prerender pages and use setHeaders to set a Cache-Control value that can be influenced by untrusted input at prerender time.
What must an attacker be able to do to exploit this issue?
The attacker must be able to influence the Cache-Control header value supplied through setHeaders while the affected page is prerendered. Exploitation also requires a user to visit the resulting prerendered page.
Are applications using a fixed Cache-Control value affected in practice?
The vulnerability is caused by an unescaped Cache-Control value reaching the generated meta tag. The provided information identifies attacker-controlled values at prerender time as the exploitation condition; it does not indicate that a fixed, trusted value is exploitable.
What is the remediation?
Upgrade @sveltejs/kit to version 3.0.0 or later. If upgrading cannot happen immediately, avoid passing untrusted data into Cache-Control values set through setHeaders for prerendered pages.