What’s Vulnerable › Vulnerabilities

CVE-2026-114061: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-28
• Weakness: CWE-79

Description

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.

Affected products

• sveltejs kit: before 3.0.0 — fixed in 3.0.0

How to fix

Upgrade to a fixed version: sveltejs kit 3.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/sveltejs/kit/security/advisories/GHSA-27mw-82g8-phjj
• https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-xss-via-cache-control-header-in-prerendered-pages

Get alerted when CVE-2026-114061 or the next vulnerability affects your stack