Is CVE-2026-114061 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114061 being exploited in the wild.

How severe is CVE-2026-114061?

Medium severity, with a CVSS score of 4.7, published 21 October 2026.

Which products and versions are affected?

@sveltejs/kit (npm) < 3.0.0, SEMVER:introduced=0,fixed=3.0.0; Svelte @Sveltejs/Kit before 3.0.0.

How is CVE-2026-114061 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114061?

Check whether you run @sveltejs/kit (npm) or Svelte @Sveltejs/Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114061: SvelteKit cross-site scripting in prerendered pages

Q: Which products and versions are affected?

@sveltejs/kit (npm) < 3.0.0, SEMVER:introduced=0,fixed=3.0.0; Svelte @Sveltejs/Kit before 3.0.0.

Q: Is there a fix for CVE-2026-114061?

Yes. @sveltejs/kit (npm): upgrade to 3.0.0 or later. Until then: Avoid forwarding untrusted cache-control header values with setHeaders on prerendered pages. Use a fixed, trusted cache policy instead. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114061 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114061?

Check whether you run @sveltejs/kit (npm) or Svelte @Sveltejs/Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114061 · Severity: medium · CVSS 4.7 · Published 2026-10-21

SvelteKit is a web framework for building fast applications with server-side rendering. Versions before 3.0.0 are vulnerable to a cross-site scripting (XSS) attack when prerendering pages with untrusted cache-control headers. An attacker who can control these headers during page generation can inject malicious JavaScript that executes in users' browsers, potentially stealing session data or performing actions on behalf of users.

Technologies: @sveltejs/kit (npm). Vendors: npm, Svelte.

Quick answers

Is CVE-2026-114061 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114061 being exploited in the wild.
How severe is CVE-2026-114061?: Medium severity, with a CVSS score of 4.7, published 21 October 2026.
Which products and versions are affected?: @sveltejs/kit (npm) < 3.0.0, SEMVER:introduced=0,fixed=3.0.0; Svelte @Sveltejs/Kit before 3.0.0.
Is there a fix for CVE-2026-114061?: Yes. @sveltejs/kit (npm): upgrade to 3.0.0 or later. Until then: Avoid forwarding untrusted cache-control header values with setHeaders on prerendered pages. Use a fixed, trusted cache policy instead. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114061 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114061?: Check whether you run @sveltejs/kit (npm) or Svelte @Sveltejs/Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@sveltejs/kit (npm): upgrade to 3.0.0 or later
```
npm install @sveltejs/kit@3.0.0
```

Avoid forwarding untrusted cache-control header values with setHeaders on prerendered pages. Use a fixed, trusted cache policy instead.

Technical details

The vulnerability is an improper output encoding (CWE-79) in SvelteKit's prerendering logic. When setHeaders is used to set a cache-control header from an untrusted source, the value is inserted directly into a meta http-equiv tag without HTML escaping. An attacker who can influence the cache-control header value at prerender time can break out of the content attribute and inject arbitrary HTML or JavaScript. Exploitation requires the ability to influence header values during the prerender phase.

Affected products

Svelte @sveltejs/kit before 3.0.0

Identifiers

CVE-2026-114061
GHSA-27mw-82g8-phjj

Timeline

2026-10-05: advisory
2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.