CVE-2026-128118: SvelteKit: Build-time server-only module import guard could fail, resulting in server secrets being statically replaced in client bundle
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 until 3.1.1, the build-time server-only module guard did not treat src/params.js as a client entry point even though parameter matchers can run in the browser. Server-only modules imported through src/params.js could consequently enter the client bundle, where statically replaced private environment values or other server secrets could be exposed. This issue is fixed in 3.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.1.1
Event History
Frequently Asked Questions
Which applications are affected?
Applications using SvelteKit versions 3.0.0 through 3.1.0 are affected if src/params.js imports server-only modules and the corresponding parameter matcher can run in the browser.
What must an attacker do to obtain exposed values?
No authentication or user interaction is required. If private environment values or other secrets were included in the generated client bundle, they may be accessible to anyone able to retrieve and inspect that bundle.
What is the remediation?
Upgrade SvelteKit to version 3.1.1, which fixes the build-time guard. Review src/params.js imports and rotate any private environment values or other server secrets that may have been included in previously deployed client bundles.
How can I determine whether secrets may already have been exposed?
Inspect src/params.js for imports of server-only modules, then examine built and deployed client assets for statically replaced private environment values or other secret content. Exposure is possible when those imports caused secrets to enter the client bundle.