Medium severity · published Oct 21, 2026
CVE-2026-114061
SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
4.7
CVSS
0.2%
EPSS
No
On KEV
Description
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
kit · sveltejs
before 3.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114061
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114061
github.com
https://github.com/sveltejs/kit/security/advisories/GHSA-27mw-82g8-phjj
www.vulncheck.com
https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-xss-via-cache-control-header-in-prerendered-pages
More from kit
9.1
CVE-2025-67647
SvelteKit Denial of service and possible SSRF when using prerendering
7.5
CVE-2026-114063
SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
7.5
CVE-2026-82261
SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
7.5
CVE-2026-82260
SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
7.5
CVE-2026-82259
SvelteKit 2.49.0 before 2.53.3 Denial of Service via form