Is CVE-2026-114062 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-114062?

CVE-2026-114062 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-114062

Description

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.