medium · CVSS v3 5.3

CVE-2026-114062

SvelteKit before 3.0.0 has a server‑side request forgery vulnerability that allows attackers to reach internal services via self‑fetch fallb

Overview

SvelteKit before 3.0.0 has a server‑side request forgery vulnerability that allows attackers to reach internal services via self‑fetch fallbacks following redirects. By manipulating Host or forwarded headers, attackers can redirect server‑side requests to malicious endpoints, exposing internal resources. This flaw can lead to unintended data exposure or internal network probing.

Description

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.

Impact

Confidentiality: internal services may be accessed by attackers. Integrity: attackers can redirect requests to malicious endpoints. Availability: potential for internal service disruption. Defenders: developers and ops teams using SvelteKit 2.x must address this.

Remediation

Upgrade to SvelteKit 3.0.0 or later. If upgrade not possible, configure the server to reject redirects from self‑fetch or validate Host/forwarded headers. Disable automatic redirect following in server‑side fetch logic. Ensure internal services are not exposed to the external network.

Risk context

The vulnerability has a medium severity score (CVSS 5.3) and no EPSS data, indicating moderate risk but still actionable. Defenders should prioritize patching or mitigation to prevent potential internal exposure.

Affected products

  • SvelteKit 2.x

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
—

sveltekit ssrf server-side redirect internal-exposure medium-severity

← All CVEs

Related CVEs

medium

CVE-2026-114088

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

View analysis

medium

CVE-2026-114054

vLLM before 0.31.0 contains a cache aliasing flaw that lets authenticated users collide cache keys via EXIF ImageID or cache_salt, potentially leaking cached media or reusing KV state. The vulnerability can be exploited by supplying crafted values in image metadata or LoRA names. It affects all deployments of vLLM older than 0.31.0.

View analysis

medium

CVE-2026-114056

ArcadeDB versions 26.8.1 to 26.10.0 contain an authorization bypass that lets read‑only users alter edge type schema flags without UPDATE_SCHEMA rights. This change persists across restarts and can affect data integrity.

View analysis

medium

CVE-2026-114057

ArcadeDB versions 26.2.1 through 26.10.0 allow authenticated users to enumerate all database names via the Bolt protocol, exposing tenant or project identifiers. The missing authorization flaw can be triggered with a simple SHOW DATABASES query. This vulnerability is present in the Bolt handler and can be exploited by any user with database credentials.

View analysis