All vulnerabilities
CVE-2026-114061GHSA-27mw-82g8-phjj

@sveltejs/kit: SvelteKit : XSS via untrusted cache-control header in prerendered page

sveltejs @sveltejs/kitnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
2.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.0.0Fixed versionGitHub
Published21 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 3.0.0@sveltejs/kit, npmGitHubnpm install @sveltejs/kit@3.0.0
  • 3.0.0kitCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Applications that prerender pages and use setHeaders to set a cache-control header from an untrusted source are vulnerable to cross-site scripting (XSS).

SvelteKit inserts the header value into a <meta http-equiv="cache-control"> tag without escaping it. An attacker who can influence this value at prerender time can break out of the content attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.

Patches

The fix escapes the header value before inserting it into the generated HTML. Upgrade to @sveltejs/kit version 3.0.0 or later.

Workarounds

Avoid forwarding untrusted cache-control header values with setHeaders on prerendered pages. Use a fixed, trusted cache policy instead.

Text from GitHub Advisory Database

Affected versions 4

  • @sveltejs/kit, npm< 3.0.0GitHub
  • kitaffected: all versions before 3.0.0CVE List
  • kitunaffected: 3.0.0CVE List
  • @sveltejs/kit, npmfrom first release, fixed in 3.0.0OSV

References 6