CVE-2026-114061 SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114061?
CVE-2026-114061 is a low-severity vulnerability in sveltejs kit, published on 21 Oct 2026.
Official description
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
Weakness: CWE-79
Which versions are affected by CVE-2026-114061?
2 open source packages ship an affected version, including @sveltejs/kit.
| Package | Affected | Fixed in |
|---|---|---|
@sveltejs/kit npm | All versions | 3.0.0 |
@sveltejs/kit npm | All versions | 3.0.0 |
How do I fix CVE-2026-114061?
Upgrade @sveltejs/kit to 3.0.0 or later.
Is CVE-2026-114061 being exploited?
There is no known exploitation of CVE-2026-114061 in the wild and no public exploit code.
Sources
Also known as GHSA-27mw-82g8-phjj.