{"id":"CVE-2026-114060","aliases":["GHSA-pfhg-q3qv-9q6r"],"url":"https://o3.security/vulnerability/CVE-2026-114060","summary":"SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions","details":"### Impact\nApplications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, such as catch-all routes, may be vulnerable to an open redirect.\n\n### Patches\nA fix has been prepared for `@sveltejs/kit` 3.0.0. Users should upgrade to 3.0.0 or later.\n\nThe fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.\n\n### Workarounds\nReject requests whose parsed URL pathname begins with `//` before route resolution, for example in a reverse proxy or a SvelteKit `handle` hook.\n\nAlternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:\n\n```svelte\n<form method=\"POST\" use:enhance={() => ({ update }) => update({ navigate: false })}>\n  <!-- form fields -->\n</form>\n```\n\nThis applies non-redirect results to the current page instead of navigating to the action location.","published":"2026-10-21T00:36:34.741Z","modified":"2026-10-24T02:49:30.499929203Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@sveltejs/kit","fixedVersion":"3.0.0"}],"fix":{"url":"https://github.com/sveltejs/kit/commit/91aae3547c6cd2935d79c09a53e27c740100000a","label":"sveltejs/kit@91aae35"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114060.json"},{"type":"ADVISORY","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114060"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions"},{"type":"WEB","url":"https://github.com/sveltejs/kit/commit/91aae3547c6cd2935d79c09a53e27c740100000a"},{"type":"PACKAGE","url":"https://github.com/sveltejs/kit"},{"type":"WEB","url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:49:30.499929203Z"}}