{"id":"CVE-2026-114062","kind":"vulnerability","aliases":["CVE-2026-114062"],"related":[],"title":"SvelteKit: self-fetch fallbacks follow redirects, enabling server-side request forgery","description":"SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.","summary":"SvelteKit before 3.0.0 makes self-fetch fallback requests that follow HTTP redirects automatically. An attacker who manipulates the Host or forwarded headers can point those requests at their own server, which redirects them to internal services.","severity":"medium","cvss":6.9,"epss":0.00288,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node","runtime","self-hosted","sveltekit"],"not_affected_if":["static-export","sveltekit-3.0.0-or-later"],"how_to_check":"- Check the installed SvelteKit version with `npm ls @sveltejs/kit`\n- Check whether the app trusts Host or X-Forwarded-Host headers from clients, which the sources do not confirm is required: unknown","fix":"- Upgrade @sveltejs/kit to `3.0.0` or later\n- Unknown whether a configuration workaround exists before upgrading","status":"open","published_at":"2026-10-21T01:17:29+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:40:17+00:00","updated_at":"2026-10-25T03:40:17+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T03:40:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade @sveltejs/kit to `3.0.0` or later\n- Unknown whether a configuration workaround exists before upgrading","reach":"internet","title":"SvelteKit: self-fetch fallbacks follow redirects, enabling server-side request forgery","impact":"medium","summary":"SvelteKit before 3.0.0 makes self-fetch fallback requests that follow HTTP redirects automatically. An attacker who manipulates the Host or forwarded headers can point those requests at their own server, which redirects them to internal services.","category":"runtime","nicknames":[],"who_cares":["sveltekit","self-hosted","node"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker reaches internal services through the server","analyst_note":"Check the SvelteKit 3.0.0 release notes and advisory at the NVD entry to confirm the exact trigger conditions and the fixed-version details.","how_to_check":"- Check the installed SvelteKit version with `npm ls @sveltejs/kit`\n- Check whether the app trusts Host or X-Forwarded-Host headers from clients, which the sources do not confirm is required: unknown","needs_analyst":true,"not_affected_if":["static-export","sveltekit-3.0.0-or-later"],"who_is_affected":"Applications built on SvelteKit versions before 3.0.0 that run a server (not purely static output) and make self-fetch fallback requests are the exposed ones. The sources do not say which exact routes or header configurations trigger the fallback path, so unknown beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000629,"input_tokens":3368,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114062':16A,19A '-2026':15A,18A '3.0.0':28B,65C 'allow':75C 'attack':41B,77C,91C 'automat':39B,90C 'contain':66C 'cve':14A,17A 'enabl':8A 'fallback':5A,33B,86C,101C 'fetch':4A,32B,85C 'follow':6A,36B,87C 'forgeri':13A,72C 'forward':47B,97C 'header':48B,98C 'host':24B,45B,95C 'http':37B,88C 'intern':61B,80C,110C 'make':29B 'manipul':43B,93C 'node':20B 'point':50B,100C 'reach':79C 'redirect':7A,38B,58B,89C,107C 'remot':76C 'request':12A,34B,52B,71C,102C 'runtim':21B 'self':3A,23B,31B,84C 'self-fetch':2A,30B,83C 'self-host':22B 'server':10A,56B,69C,105C 'server-sid':9A,68C 'servic':62B,81C,111C 'side':11A,70C 'sveltekit':1A,25B,26B,63C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Applications built on SvelteKit versions before 3.0.0 that run a server (not purely static output) and make self-fetch fallback requests are the exposed ones. The sources do not say which exact routes or header configurations trigger the fallback path, so unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114062","severity":null,"published_at":"2026-10-21T01:17:29+00:00","modified_at":"2026-10-22T18:17:27+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114062","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114062","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}