CVE-2026-114062

SvelteKit versions prior to 3.0.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The root cause is that server-side self-fetch fallbacks automatically follow HTTP redirects. Remote attackers can exploit this by manipulating the Host header or other forwarded headers to poin...