# CVE-2026-114060: SvelteKit open redirect in enhanced form actions

Source: https://junglewise.ai/threats/cve-2026-114060-sveltekit-sveltejs-kit-before-3-0-0-contains-an-open-redirect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114060 · Severity: medium · CVSS 4.7 · Published 2026-10-21

SvelteKit is a web application framework used to build modern JavaScript applications. A flaw in enhanced form submission allows attackers to craft malicious form actions that redirect users to attacker-controlled websites. This could be exploited to steal credentials, spread malware, or conduct phishing attacks by making victims visit untrusted sites they didn't intend to access.

Technologies: [@sveltejs/kit (npm)](https://junglewise.ai/threats/technologies/sveltejs-kit). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-114060 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114060 being exploited in the wild.

**How severe is CVE-2026-114060?** Medium severity, with a CVSS score of 4.7, published 21 October 2026.

**Which products and versions are affected?** @sveltejs/kit (npm) < 3.0.0, SEMVER:introduced=0,fixed=3.0.0; Svelte Labs @Sveltejs/Kit before 3.0.0.

**Is there a fix for CVE-2026-114060?** Yes. @sveltejs/kit (npm): upgrade to 3.0.0 or later. Until then: Reject requests whose parsed URL pathname begins with // before route resolution in a reverse proxy or SvelteKit handle hook. Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback that sets navigate to false. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114060 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114060?** Check whether you run @sveltejs/kit (npm) or Svelte Labs @Sveltejs/Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @sveltejs/kit (npm): upgrade to 3.0.0 or later

  ```sh
  npm install @sveltejs/kit@3.0.0
  ```


Reject requests whose parsed URL pathname begins with // before route resolution in a reverse proxy or SvelteKit handle hook. Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback that sets navigate to false.

## Technical details

An open redirect vulnerability exists in enhanced form actions (use:enhance) on routes that accept paths beginning with double slashes (//). Attackers can craft action paths starting with // that are interpreted as protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled origins. The fix in 3.0.0 preserves leading double slashes without generating protocol-relative URLs and restricts non-redirect navigation to the current origin.

## Affected products

- Svelte Labs @sveltejs/kit before 3.0.0

## Identifiers

- CVE-2026-114060
- GHSA-pfhg-q3qv-9q6r

## Timeline

- 2026-10-05: disclosed: GitHub security advisory published
- 2026-10-21: patched: CVE-2026-114060 published
- 2026-10-21: advisory

## References

- [https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r](https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r)
- [https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions](https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions)

## Related threats

- [SvelteKit XSS via cache-control header in prerendered pages](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-xss-via-cache-control-header-5731f4e1)
- [SvelteKit open redirect in enhanced form actions](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-open-redirect-via-enhanced-9a8dcd94)
- [SvelteKit cross-site scripting in prerendered pages](https://junglewise.ai/threats/cve-2026-114061-sveltekit-sveltejs-kit-before-3-0-0-contains-a-cross-site)
- [SvelteKit CPU exhaustion in remote form deserialization](https://junglewise.ai/threats/cve-2026-82261-sveltekit-cpu-exhaustion-in-remote-form-deserialization)
- [SvelteKit memory exhaustion in remote form deserialization](https://junglewise.ai/threats/cve-2026-82260-sveltekit-memory-exhaustion-in-remote-form-deserialization)