@SVELTEJS/KIT · GHSA-m9j8-jcmv-hp69 · Package
FIX → 3.1.1
Under certain conditions, modules meant only for the server can end up in the browser build of a SvelteKit app. Server secrets referenced through those imports can then be read by anyone who loads the client bundle.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only apps that use src/params.js to import server-only modules are exposed. Apps that do not import server-only code through that file, or that run an unaffected version, can skip this.
Not affected if no-params-js-server-imports, version-outside-range
Who cares npm, svelte, sveltekit
npm ls @sveltejs/kit and confirm whether the installed version is between 3.0.0 and 3.1.0.src/params.js imports any server-only module that contains secrets.Upgrade to 3.1.1
Under certain circumstances, server-only imports, which typically cannot be included in the client bundle, could make their way into it, potentially exposing secrets. This could only occur when those server-only imports were made through src/params.js.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
@sveltejs/kit3.1.1