---
id: "GHSA-prjg-x2qj-wj3g"
page: "https://infrastack.ai/live/GHSA-prjg-x2qj-wj3g"
kind: "vulnerability"
aliases: ["GHSA-prjg-x2qj-wj3g"]
title: "SSRF via redirects in server-side self-fetch fallbacks"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@sveltejs/kit", "fixed": [">= 2.70.4"], "affected": "<= 2.70.3", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["adapter-node", "node", "package", "self-hosted", "svelte", "sveltekit"]
not_affected_if: ["default-config", "managed-hosting", "static-export"]
published_at: "2026-10-05T19:34:37+00:00"
first_seen_at: "2026-11-09T22:53:16+00:00"
updated_at: "2026-11-09T23:01:10+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-prjg-x2qj-wj3g", "first_seen_at": "2026-11-09T22:53:16+00:00"}]
exploit_sources: []
---

# SSRF via redirects in server-side self-fetch fallbacks

Link for people: https://infrastack.ai/live/GHSA-prjg-x2qj-wj3g (this .md is for agents)

SvelteKit's server makes internal self-fetch requests to URLs built from the incoming request origin, and it followed HTTP redirects on those requests. An attacker who controls the origin and a server they host can redirect the server to internal services, reaching targets the attacker could not reach directly.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@sveltejs/kit affected <= 2.70.3 fixed >= 2.70.4

## How to check

- Check the installed version: `npm ls @sveltejs/kit`
- Look for `adapter-node` and whether the origin comes from the `Host` or forwarded headers without validation
- Check whether `paths.origin` is set in `svelte.config.js`

## Fix

- `@sveltejs/kit`: move to `3.0.0` or later (affected up to `2.70.3`, fixed from `2.70.4` per product data; advisory says fixed in `3.0.0`)
- Workaround: set `paths.origin` to the trusted origin for `adapter-node`, or validate hosts at a trusted reverse proxy

## Timeline

- 2026-11-09T22:53:16+00:00 ghsa-repo https://github.com/sveltejs/kit/security/advisories/GHSA-prjg-x2qj-wj3g

## Documents

- [advisory] Vendor advisory: github.com https://github.com/sveltejs/kit/security/advisories/GHSA-prjg-x2qj-wj3g

## From the sources

### Impact

In certain circumstances, SvelteKit makes server-side fallback requests to URLs derived from the incoming request origin. These self-fetches occur when retrieving prerendered data for experimental `prerender` remote functions, serving rerouted prerendered content, fetching static or prerendered resources without an internal read implementation, and handling same-origin subrequests that cannot be resolved from the server manifest (including during error-page rendering).

If an attacker can influence the request origin and trigger one of these fallback paths, SvelteKit can make a request to an attacker-controlled server. These requests previously followed HTTP redirects automatically, allowing that server to redirect the request to an internal service and cause server-side request forgery (SSRF).

Exposure depends on the adapter and deployment configuration. For example, this can occur with `adapter-node` when the request origin is derived from unvalidated `Host` or forwarded host/protocol headers.

### Patches

Fixed in version 3.0.0.

The fix disables automatic redirect following for these framework self-fetch fallbacks. It prevents an attacker-controlled first response from causing further server-side requests through redirects; it does not validate or restrict the origin of the initial request.

### Workarounds

Configure a trusted fixed request origin where supported. For `adapter-node`, set the `paths.origin` configuration to the application’s trusted origin. Alternatively, use a trusted reverse proxy that validates the allowed request hosts and supplies trusted host/protocol metadata. Forwarded headers used to construct the request origin must not be accepted directly from untrusted clients.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_