Skip to content
Vulnerability intelligence

CVE-2026-114061: SvelteKit cross-site scripting

Only apps that prerender pages and copy cache headers from untrusted sources are exposed. The fix is version 3.0.0.

SvelteKit 2026