CVE-2026-128116

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, apps configured with router.resolution: 'server' could treat a pathname beginning with // as a protocol-relative module specifier during client-side navigation. A socially engineered link could therefore make server-side route resolution import and execute JavaScript from another origin in the user's browser. This issue is fixed in 2.70.4 and 3.1.1.

References

• https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd
• https://github.com/sveltejs/kit/commit/a8f7c1e09f13524d3b71d814bad9c15c9f33ef49
• https://github.com/sveltejs/kit/pull/17620
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.4
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1