CVE-2026-128118
Received Received - Intake

SvelteKit Server-Only Module Exposure via Params.js

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 until 3.1.1, the build-time server-only module guard did not treat src/params.js as a client entry point even though parameter matchers can run in the browser. Server-only modules imported through src/params.js could consequently enter the client bundle, where statically replaced private environment values or other server secrets could be exposed. This issue is fixed in 3.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128118
EUVD
EUVD-2026-125730

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
svelte sveltekit to 3.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-668 The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SvelteKit versions 3.0.0 to 3.1.0. The build-time server-only module guard failed to treat src/params.js as a client entry point, allowing server-only modules to be included in the client bundle. This could expose server secrets or private environment values statically replaced in client-side code.

Detection Guidance

Check if your SvelteKit version is between 3.0.0 and 3.1.0. Inspect src/params.js for server-only module imports. Review client bundle output for statically replaced private environment values or server secrets.

Impact Analysis

An attacker could access sensitive server information if server-only modules are included in the client bundle. This may lead to unauthorized data exposure, such as private environment variables or other secrets, compromising application security.

Mitigation Strategies

Upgrade SvelteKit to version 3.1.1 or later. Remove any server-only module imports from src/params.js. Audit client bundles for exposed secrets and regenerate them after upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128118. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...