- GitHub's advisory says SvelteKit apps using enhanced forms on routes that accept paths starting with // may be open to a redirect to another site.
- The advisory names @sveltejs/kit 3.0.0 as the fix and lists two stopgaps: blocking such paths at the proxy, or changing how forms handle results.
- Teams should find apps using the feature on routes that accept // paths, such as catch-all routes, and decide whether to block such paths while testing 3.0.0.
A convenience feature that trusts a path too much
Frameworks save teams time by taking over small jobs. In SvelteKit, one of those jobs is form handling. Adding use:enhance to a form makes it submit without a full page reload. It feels like an app, and developers rarely think about it again.
That is why a new GitHub advisory deserves a short read. The GitHub Advisory Database, in an entry published on October 23, says applications using enhanced form actions on routes that accept paths beginning with // "may be vulnerable to an open redirect." Catch-all routes, which accept almost any path, are the example it gives.
What an open redirect does
An open redirect lets a visitor who starts on your domain end up on another site. The advisory title calls it a redirection to an untrusted site. The visitor sees your address first, and that can make the next page seem trustworthy.
The advisory does not report any exploitation. It also gives no severity score in the text WebPulse reviewed. The flaw is described, and the fix is described. Beyond that, the entry is brief.
How the flaw works
A path with one slash, such as /account, means a page on the same site. A path with two slashes, such as //example.com, is read by browsers as an address on a different site. These are called protocol-relative URLs.
The advisory's fix description points to this spot. The patch keeps leading double slashes in form action paths "without generating protocol-relative URLs." It also stops navigation after an ordinary form result from leaving the current site. And when the framework compares a form's target with the page the user is on, it now takes the site address into account.
This suggests that an enhanced form could navigate to an address the application never meant to use. That is an interpretation. The advisory does not walk through an attack step by step.
Three ways to respond
The advisory names a single patched release: @sveltejs/kit 3.0.0. Teams on older versions should plan to move to it or to anything newer. A new major version usually calls for testing, so some teams will not finish this week.
For that gap, the advisory offers two stopgaps. The first is to block any request whose path starts with // before the framework picks a route. It suggests doing this in a reverse proxy or in a SvelteKit handle hook. The proxy option can be set up by an infrastructure team without a new application release.
The second is to give the form a custom submission callback. With that in place, the form keeps the user on the page they are already viewing when the server returns any result that is not a redirect. The browser is no longer sent to the address the form targets.
What the public record shows
The advisory links to the NVD entry for CVE-2026-114060. It also links to the 3.0.0 release page and to a VulnCheck advisory with the same finding.
WebPulse's profile built from NIST NVD data, refreshed October 23, lists 10 CVEs for SvelteKit. None is rated critical and none is in the CISA Known Exploited Vulnerabilities catalog. That history supports treating this as a patch-and-test item. It is a count of public records, not a comparison with other frameworks.
Questions to put to your team
Ask which of your applications use SvelteKit. Then ask which of them use use:enhance on catch-all routes or on any route that accepts paths starting with //. Those are the ones the advisory describes.
Ask whether the proxy can reject paths that begin with // today, and who owns that rule. Ask how long testing 3.0.0 will take, and whether the stopgap is documented until then. Ask whether anyone reviews logs for requests that start with //.
The lesson is a small one. Features that save developers time also decide where visitors go. A slash is cheap to type, and it pays to check where a path points.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: GitHub Advisory Database.
