< Back

CVE-2026-114060

Updated on 21 Oct 2026

Severity

2.1 Low severity

Details

CVSS score
2.1
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Impact

Applications using enhanced form actions (use:enhance) on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect.

Patches

A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later.

The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.

Workarounds

Reject requests whose parsed URL pathname begins with // before route resolution, for example in a reverse proxy or a SvelteKit handle hook.

Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:

&lt;form method="POST" use:enhance={() =&gt; ({ update }) =&gt; update({ navigate: false })}&gt;
&lt;!-- form fields --&gt;
&lt;/form&gt;

This applies non-redirect results to the current page instead of navigating to the action location.

Details

Affected product:
arcjet-js , kit , sanity-svelte-loader , scalar-sveltekit , sentry-sveltekit , sveltejs-adapter-bun , sveltejs-adapter-node , sveltejs-adapter-static , sveltejs-adapter-vercel , sveltejs-kit , visual-editing
Affected packages:
@sveltejs/kit @ 2.70.3 (+197 more)