GHSA-27mw-82g8-phjj: XSS

Q: Which applications are exposed to this issue?

Applications are exposed only if they prerender pages and use setHeaders to set a cache-control header from an untrusted source. The attacker-controlled value must be present during prerendering, where it is inserted into the generated page.

Q: What does an attacker need to exploit the vulnerability?

An attacker must be able to influence the cache-control header value used by setHeaders at prerender time. They can use a value that escapes the meta tag's content attribute and injects HTML or JavaScript that runs when visitors load the generated page.

Q: What can be done before upgrading?

Do not forward untrusted cache-control values through setHeaders on prerendered pages. Set a fixed, trusted cache policy instead.

Q: How can I determine whether an application may be affected?

Review prerendered routes for setHeaders calls that set cache-control. Determine whether the assigned value can originate from user-controlled or otherwise untrusted input; fixed trusted values are not described as vulnerable.

Published Oct 23, 2026

Updated

Impact

Applications that prerender pages and use setHeaders to set a cache-control header from an untrusted source are vulnerable to cross-site scripting (XSS).

SvelteKit inserts the header value into a <meta http-equiv="cache-control"> tag without escaping it. An attacker who can influence this value at prerender time can break out of the content attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.

Patches

The fix escapes the header value before inserting it into the generated HTML. Upgrade to @sveltejs/kit version 3.0.0 or later.

Workarounds

Avoid forwarding untrusted cache-control header values with setHeaders on prerendered pages. Use a fixed, trusted cache policy instead.

Affected Software

1 affected componentFixes available

npm/@sveltejs/kit<3.0.0

3.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@sveltejs/kit to a version that resolves this vulnerability.
Fixed in 3.0.0
Upgrade
Upgrade @sveltejs/kit to a version that resolves this vulnerability.
Fixed in 3.0.0
Configuration
Do not forward untrusted cache-control header values with setHeaders; use a fixed, trusted cache policy instead.
SvelteKit prerendered pages setHeaders cache-control = fixed, trusted cache policy

Event History

Oct 23, 2026

Advisory Published

via GitHub·08:43 PM

Data Sourced

via GitHub·08:43 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications are exposed only if they prerender pages and use setHeaders to set a cache-control header from an untrusted source. The attacker-controlled value must be present during prerendering, where it is inserted into the generated page.

What does an attacker need to exploit the vulnerability?

An attacker must be able to influence the cache-control header value used by setHeaders at prerender time. They can use a value that escapes the meta tag's content attribute and injects HTML or JavaScript that runs when visitors load the generated page.

What can be done before upgrading?

Do not forward untrusted cache-control values through setHeaders on prerendered pages. Set a fixed, trusted cache policy instead.

How can I determine whether an application may be affected?

Review prerendered routes for setHeaders calls that set cache-control. Determine whether the assigned value can originate from user-controlled or otherwise untrusted input; fixed trusted values are not described as vulnerable.

GHSA-27mw-82g8-phjj: XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What can be done before upgrading?

How can I determine whether an application may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What can be done before upgrading?

How can I determine whether an application may be affected?