@SVELTEJS/KIT · GHSA-rqp5-r3wg-vg35 · Package
FIX → 3.1.1 · 2.70.4
A crafted link can make SvelteKit's client-side navigation import and run a script from a different domain. An attacker who gets a user to click such a link can run code in that user's browser session.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only apps that set router.resolution: 'server' are exposed, because the flaw is in how server-side route resolution builds the module import path. Apps using the default client-side resolution are not affected according to the advisory. Teams that run SvelteKit apps with that setting should upgrade.
Not affected if default-config, no-server-route-resolution
Who cares npm, svelte, sveltekit
router.resolution: 'server' in the SvelteKit config file (svelte.config.js); apps without it are not affected.npm ls @sveltejs/kit; versions <= 2.70.3 and >= 3.0.0 <= 3.1.0 are affected.If an attacker could, using some form of social engineering or other exploit, get a user to use client-side navigation to navigate to a specially-crafted link, the attacker could cause code from another domain to be imported and run on the user's machine. This only affected apps with router.resolution: 'server'.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 3.1.1 · 2.70.4
@sveltejs/kit 2.70.4 for the 2.x line@sveltejs/kit 3.1.1 for the 3.x line