CVE-2026-114062: SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SvelteKit deployments running a version before 3.0.0 are affected where server-side self-fetch fallbacks can be influenced through the Host or forwarded headers. An attacker must be able to send requests to the application remotely; no authentication or user interaction is required.
What does an attacker need to do to exploit it?
The attacker manipulates the Host or forwarded headers so that a server-side fallback request is directed to an attacker-controlled server. That server then returns an HTTP redirect to an internal service, which the fallback follows automatically.
What is the practical impact?
Successful exploitation can cause the SvelteKit server to make requests to internal services that are not directly reachable by the attacker. The listed impact is limited to confidentiality; integrity and availability impacts are not indicated.
What should be prioritized for remediation?
Upgrade SvelteKit to 3.0.0 or later. The provided information does not specify a workaround for deployments that cannot immediately upgrade.