EUVD-2026-107012

SvelteKit : XSS via untrusted cache-control header in prerendered page...

Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27mw-82g8-phjj. This link is maintained to preserve external references. Original Description SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a...

CVE-2026-114061

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

CVE-2026-114061 SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

CVE-2026-114061 SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

CVE-2026-114061

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

CVE-2026-114061

SvelteKit (@sveltejs/kit ) versions before 3.0.0 are vulnerable to a cross-site scripting (XSS) flaw in prerendered pages. The root cause is the lack of proper escaping when a cache-control header value, set via setHeaders, is inserted into a tag. If an attacker can influence this untrusted valu...

PT-2026-120187

Name of the Vulnerable Software and Affected Versions SvelteKit @sveltejs/kit versions prior to 3.0.0 Description Prerendered pages are subject to cross-site scripting XSS because a cache-control header value defined via the setHeaders function is inserted into a tag without proper escaping. An...

CVE-2026-25545 Astro has Full-Read SSRF in error rendering via Host: header injection

Astro is a web framework. Prior to version 9.5.4, Server-Side Rendered pages that return an error with a prerendered custom error page eg. 404.astro or 500.astro are vulnerable to SSRF. If the Host: header is changed to an attacker's server, it will be fetched on /500.html and they can redirect...

GHSA-P6JQ-8VC4-79F6 Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival

Summary A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. Technical Details The vulnerability occurs in...

PT-2025-38250

Name of the Vulnerable Software and Affected Versions: Nuxt versions prior to 3.19.0 Nuxt versions prior to 4.1.0 Description: A client-side path traversal vulnerability exists in Nuxt's Island payload revival mechanism. This allows attackers to manipulate client-side requests to different...

GHSA-G5M6-HXPP-FC49 Sending a GET or HEAD request with a body crashes SvelteKit

Summary In SvelteKit 2 sending a GET request with a body eg to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD method cannot have body. and crashes the app. node:internal/deps/undici/undici:6066 throw new TypeError"Request with GET/HEAD method cannot have body."; ^...