Is CVE-2026-114060 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114060 being exploited in the wild.

How severe is CVE-2026-114060?

Medium severity, with a CVSS score of 4.7, published 21 October 2026.

Which products and versions are affected?

@sveltejs/kit (npm) < 3.0.0, SEMVER:introduced=0,fixed=3.0.0; Svelte Labs @Sveltejs/Kit before 3.0.0.

How is CVE-2026-114060 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114060?

Check whether you run @sveltejs/kit (npm) or Svelte Labs @Sveltejs/Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114060: SvelteKit open redirect in enhanced form actions

Q: Which products and versions are affected?

@sveltejs/kit (npm) < 3.0.0, SEMVER:introduced=0,fixed=3.0.0; Svelte Labs @Sveltejs/Kit before 3.0.0.

Q: Is there a fix for CVE-2026-114060?

Yes. @sveltejs/kit (npm): upgrade to 3.0.0 or later. Until then: Reject requests whose parsed URL pathname begins with // before route resolution in a reverse proxy or SvelteKit handle hook. Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback that sets navigate to false. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114060 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114060?

Check whether you run @sveltejs/kit (npm) or Svelte Labs @Sveltejs/Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114060 · Severity: medium · CVSS 4.7 · Published 2026-10-21

SvelteKit is a web application framework used to build modern JavaScript applications. A flaw in enhanced form submission allows attackers to craft malicious form actions that redirect users to attacker-controlled websites. This could be exploited to steal credentials, spread malware, or conduct phishing attacks by making victims visit untrusted sites they didn't intend to access.

Technologies: @sveltejs/kit (npm). Vendors: npm.

Quick answers

Is CVE-2026-114060 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114060 being exploited in the wild.
How severe is CVE-2026-114060?: Medium severity, with a CVSS score of 4.7, published 21 October 2026.
Which products and versions are affected?: @sveltejs/kit (npm) < 3.0.0, SEMVER:introduced=0,fixed=3.0.0; Svelte Labs @Sveltejs/Kit before 3.0.0.
Is there a fix for CVE-2026-114060?: Yes. @sveltejs/kit (npm): upgrade to 3.0.0 or later. Until then: Reject requests whose parsed URL pathname begins with // before route resolution in a reverse proxy or SvelteKit handle hook. Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback that sets navigate to false. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114060 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114060?: Check whether you run @sveltejs/kit (npm) or Svelte Labs @Sveltejs/Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@sveltejs/kit (npm): upgrade to 3.0.0 or later
```
npm install @sveltejs/kit@3.0.0
```

Reject requests whose parsed URL pathname begins with // before route resolution in a reverse proxy or SvelteKit handle hook. Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback that sets navigate to false.

Technical details

An open redirect vulnerability exists in enhanced form actions (use:enhance) on routes that accept paths beginning with double slashes (//). Attackers can craft action paths starting with // that are interpreted as protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled origins. The fix in 3.0.0 preserves leading double slashes without generating protocol-relative URLs and restricts non-redirect navigation to the current origin.

Affected products

Svelte Labs @sveltejs/kit before 3.0.0

Identifiers

CVE-2026-114060
GHSA-pfhg-q3qv-9q6r

Timeline

2026-10-05: disclosed: GitHub security advisory published
2026-10-21: patched: CVE-2026-114060 published
2026-10-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.