CVE-2026-114061: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

Q: Which deployments are exposed?

Deployments using @sveltejs/kit versions before 3.0.0 are exposed if they prerender pages and use setHeaders to set a Cache-Control value that can be influenced by untrusted input at prerender time.

Q: What must an attacker be able to do to exploit this issue?

The attacker must be able to influence the Cache-Control header value supplied through setHeaders while the affected page is prerendered. Exploitation also requires a user to visit the resulting prerendered page.

Q: Are applications using a fixed Cache-Control value affected in practice?

The vulnerability is caused by an unescaped Cache-Control value reaching the generated meta tag. The provided information identifies attacker-controlled values at prerender time as the exploitation condition; it does not indicate that a fixed, trusted value is exploitable.

Q: What is the remediation?

Upgrade @sveltejs/kit to version 3.0.0 or later. If upgrading cannot happen immediately, avoid passing untrusted data into Cache-Control values set through setHeaders for prerendered pages.

Published Oct 21, 2026

Updated

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.

Affected Software

1 affected component

npm/@sveltejs/kit<3.0.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using @sveltejs/kit versions before 3.0.0 are exposed if they prerender pages and use setHeaders to set a Cache-Control value that can be influenced by untrusted input at prerender time.

What must an attacker be able to do to exploit this issue?

The attacker must be able to influence the Cache-Control header value supplied through setHeaders while the affected page is prerendered. Exploitation also requires a user to visit the resulting prerendered page.

Are applications using a fixed Cache-Control value affected in practice?

The vulnerability is caused by an unescaped Cache-Control value reaching the generated meta tag. The provided information identifies attacker-controlled values at prerender time as the exploitation condition; it does not indicate that a fixed, trusted value is exploitable.

What is the remediation?

Upgrade @sveltejs/kit to version 3.0.0 or later. If upgrading cannot happen immediately, avoid passing untrusted data into Cache-Control values set through setHeaders for prerendered pages.

CVE-2026-114061: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker be able to do to exploit this issue?

Are applications using a fixed Cache-Control value affected in practice?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker be able to do to exploit this issue?

Are applications using a fixed Cache-Control value affected in practice?

What is the remediation?