CVE-2026-114060 — @sveltejs/kit
Fix: sveltejs/kit@91aae35CVE-2026-114060 is a Open Redirect vulnerability in @sveltejs/kit. A fix is available for @sveltejs/kit — see the affected versions and patch details below.
SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-114060.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@sveltejs/kitnpmDescription
Impact
Applications using enhanced form actions (use:enhance) on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect.
Patches
A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later.
The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.
Workarounds
Reject requests whose parsed URL pathname begins with // before route resolution, for example in a reverse proxy or a SvelteKit handle hook.
Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:
<form method="POST" use:enhance={() => ({ update }) => update({ navigate: false })}>
<!-- form fields -->
</form>
This applies non-redirect results to the current page instead of navigating to the action location.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @sveltejs/kit | all versions | 3.0.0npm install @sveltejs/kit@3.0.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @sveltejs/kit, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update @sveltejs/kit to 3.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-114060 is resolved across your whole dependency graph.
Workarounds
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
Frequently Asked Questions
Is CVE-2026-114060 in your dependencies?
Find it across npm, including transitive dependencies.