---
id: "CVE-2026-114060"
kind: "vulnerability"
aliases: ["CVE-2026-114060", "GHSA-pfhg-q3qv-9q6r"]
title: "SvelteKit: URL redirection to untrusted site via enhanced form submission"
severity: "medium"
cvss: 4.7
epss: 0.00165
exploited: false
status: "open"
category: "runtime"
products: [{"name": "@sveltejs/kit", "fixed": ["3.0.0"], "affected": "< 3.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-601", "npm", "runtime", "svelte", "sveltekit"]
not_affected_if: ["no-catch-all-routes", "no-use-enhance-forms", "on-3.0.0-or-later"]
published_at: "2026-10-21T01:17:29+00:00"
first_seen_at: "2026-10-23T20:59:05+00:00"
updated_at: "2026-10-23T21:57:27+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-pfhg-q3qv-9q6r", "first_seen_at": "2026-10-23T20:59:05+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114060", "first_seen_at": "2026-10-23T21:57:27+00:00"}]
---

# SvelteKit: URL redirection to untrusted site via enhanced form submission

SvelteKit apps using enhanced form actions (use:enhance) on routes that accept paths starting with // can redirect users after form submission. An attacker can use this to send victims to an arbitrary external site, which enables phishing.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@sveltejs/kit affected < 3.0.0 fixed 3.0.0

## How to check

Check the @sveltejs/kit version in package.json or the lockfile; below 3.0.0 is affected. Look for use:enhance forms on catch-all or other routes that accept paths beginning with //.

## Fix

Upgrade @sveltejs/kit to 3.0.0 or later. Until then, reject requests whose pathname begins with // in a reverse proxy or a SvelteKit handle hook, or pass a custom use:enhance callback with update({ navigate: false }).

## Timeline

- 2026-10-23T20:59:05+00:00 ghsa https://github.com/advisories/GHSA-pfhg-q3qv-9q6r
- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114060

## From the sources

### Impact
Applications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, such as catch-all routes, may be vulnerable to an open redirect.

### Patches
A fix has been prepared for `@sveltejs/kit` 3.0.0. Users should upgrade to 3.0.0 or later.

The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.

### Workarounds
Reject requests whose parsed URL pathname begins with `//` before route resolution, for example in a reverse proxy or a SvelteKit `handle` hook.

Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:

```svelte
<form method="POST" use:enhance={() => ({ update }) => update({ navigate: false })}>
  <!-- form fields -->
</form>
```

This applies non-redirect results to the current page instead of navigating to the action location.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_