Live › vulnerability › CVE-2026-114062
Go to dashboardSvelteKit before 3.0.0 makes self-fetch fallback requests that follow HTTP redirects automatically. An attacker who manipulates the Host or forwarded headers can point those requests at their own server, which redirects them to internal services.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built on SvelteKit versions before 3.0.0 that run a server (not purely static output) and make self-fetch fallback requests are the exposed ones. The sources do not say which exact routes or header configurations trigger the fallback path, so unknown beyond that.
No product ranges from the sources yet.
npm ls @sveltejs/kit3.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.
This page as .md · .json · in your agent: get_signal("CVE-2026-114062")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.