CVE-2026-114061 sveltejs CVE debrief

Who should care

Defenders responsible for SvelteKit applications that use prerendering and set `cache-control` headers from untrusted sources should assess exposure and prioritize remediation. They must verify if their SvelteKit applications are using prerendering and setting `cache-control` headers from untrusted sources, and then plan and implement the necessary upgrades or mitigations.

Why it matters

CVE-2026-114061 is a cross-site scripting (XSS) vulnerability in SvelteKit that allows an attacker to inject malicious code into the generated page. Defenders should prioritize remediation by upgrading to `@sveltejs/kit` version 3.0.0 or later and avoid forwarding untrusted `cache-control` header values with `setHeaders` on prerendered pages.

• Cross-site scripting (XSS) can allow an attacker to inject malicious code into the generated page, which can execute when users visit the page.
• Defenders need to verify if their SvelteKit applications are using prerendering and setting `cache-control` headers from untrusted sources.
• Remediation requires upgrading to `@sveltejs/kit` version 3.0.0 or later.

Technical summary

Applications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS). SvelteKit inserts the header value into a `<meta http-equiv='cache-control'>` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page.

Defensive priority

Defenders should prioritize upgrading to `@sveltejs/kit` version 3.0.0 or later to remediate the vulnerability. Additionally, defenders should avoid forwarding untrusted `cache-control` header values with `setHeaders` on prerendered pages and use a fixed, trusted cache policy instead.

Recommended defensive actions

• Upgrade to `@sveltejs/kit` version 3.0.0 or later
• Avoid forwarding untrusted `cache-control` header values with `setHeaders` on prerendered pages
• Use a fixed, trusted cache policy instead
• Confirm whether affected SvelteKit applications exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by SvelteKit inserting the `cache-control` header value into a `<meta http-equiv='cache-control'>` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.