CVE-2026-114062

Received Received - Intake

Server-Side Request Forgery in SvelteKit Before 3.0.0

Publication date: 2026-10-21

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114062

EUVD

EUVD-2026-107013

Affected Vendors & Products

Vendor	Product	Version / Range
sveltejs	kit	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

SvelteKit before version 3.0.0 has a Server-Side Request Forgery (SSRF) vulnerability. It occurs because server-side self-fetch fallbacks automatically follow HTTP redirects. Attackers can manipulate the Host or forwarded headers to redirect these fallback requests to internal services, potentially accessing unauthorized resources.

Detection Guidance

To detect this SSRF vulnerability in SvelteKit versions before 3.0.0, inspect network traffic for unexpected internal service requests. Check logs for fallback requests to internal IPs or services. Use tools like curl to test if redirects from external URLs reach internal endpoints by manipulating Host headers.

Impact Analysis

This vulnerability allows remote attackers to reach internal services by exploiting SSRF. Attackers could gain unauthorized access to internal resources, exfiltrate data, or perform actions on internal systems through manipulated requests.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal services, potentially exposing sensitive data. For GDPR, this may violate Article 32 on security of processing. For HIPAA, it risks unauthorized access to protected health information. Compliance could be impacted if the vulnerability results in data breaches or unauthorized disclosures.

Mitigation Strategies

Upgrade SvelteKit to version 3.0.0 or later to disable automatic redirect following in server-side fallbacks. As a temporary workaround, configure a trusted fixed request origin or deploy a reverse proxy to validate allowed request hosts before processing.

Hi! I’m here to help you understand CVE-2026-114062. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...