---
id: "CVE-2026-114062"
kind: "vulnerability"
aliases: ["CVE-2026-114062"]
title: "SvelteKit: self-fetch fallbacks follow redirects, enabling server-side request forgery"
severity: "medium"
cvss: 6.9
epss: 0.00288
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["node", "runtime", "self-hosted", "sveltekit"]
not_affected_if: ["static-export", "sveltekit-3.0.0-or-later"]
published_at: "2026-10-21T01:17:29+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:40:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114062", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114062", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# SvelteKit: self-fetch fallbacks follow redirects, enabling server-side request forgery

SvelteKit before 3.0.0 makes self-fetch fallback requests that follow HTTP redirects automatically. An attacker who manipulates the Host or forwarded headers can point those requests at their own server, which redirects them to internal services.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SvelteKit version with `npm ls @sveltejs/kit`
- Check whether the app trusts Host or X-Forwarded-Host headers from clients, which the sources do not confirm is required: unknown

## Fix

- Upgrade @sveltejs/kit to `3.0.0` or later
- Unknown whether a configuration workaround exists before upgrading

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114062
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114062

## From the sources

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_