CVE-2026-114062: SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks

Q: Which deployments are exposed to this issue?

SvelteKit deployments running a version before 3.0.0 are affected where server-side self-fetch fallbacks can be influenced through the Host or forwarded headers. An attacker must be able to send requests to the application remotely; no authentication or user interaction is required.

Q: What does an attacker need to do to exploit it?

The attacker manipulates the Host or forwarded headers so that a server-side fallback request is directed to an attacker-controlled server. That server then returns an HTTP redirect to an internal service, which the fallback follows automatically.

Q: What is the practical impact?

Successful exploitation can cause the SvelteKit server to make requests to internal services that are not directly reachable by the attacker. The listed impact is limited to confidentiality; integrity and availability impacts are not indicated.

Q: What should be prioritized for remediation?

Upgrade SvelteKit to 3.0.0 or later. The provided information does not specify a workaround for deployments that cannot immediately upgrade.

Published Oct 21, 2026

Updated

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.

Affected Software

1 affected component

SvelteKit SvelteKit<3.0.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

SvelteKit deployments running a version before 3.0.0 are affected where server-side self-fetch fallbacks can be influenced through the Host or forwarded headers. An attacker must be able to send requests to the application remotely; no authentication or user interaction is required.

What does an attacker need to do to exploit it?

The attacker manipulates the Host or forwarded headers so that a server-side fallback request is directed to an attacker-controlled server. That server then returns an HTTP redirect to an internal service, which the fallback follows automatically.

What is the practical impact?

Successful exploitation can cause the SvelteKit server to make requests to internal services that are not directly reachable by the attacker. The listed impact is limited to confidentiality; integrity and availability impacts are not indicated.

What should be prioritized for remediation?

Upgrade SvelteKit to 3.0.0 or later. The provided information does not specify a workaround for deployments that cannot immediately upgrade.

CVE-2026-114062: SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit it?

What is the practical impact?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit it?

What is the practical impact?

What should be prioritized for remediation?