CVE-2026-128116

The SvelteKit framework is vulnerable to cross-origin script execution in versions prior to 2.70.4 and 3.1.1 . When configured with router.resolution: 'server', the application may treat pathnames starting with // as protocol-relative module specifiers during client-side navigation. This allows a...