CVE-2026-128118

The SvelteKit framework (versions 3.0.0 through 3.1.1) contains a build-time vulnerability where the server-only module guard fails to identify src/params.js as a client entry point. Because parameter matchers can execute in the browser, server-only modules imported via this file may be incorrect...