---
id: CVE-2026-114060
aliases:
  - GHSA-pfhg-q3qv-9q6r
title: 'SvelteKit: URL redirection to untrusted site via enhanced form submission'
summary: 'SvelteKit: URL redirection to untrusted site via enhanced form submission'
severity: low
cvss: 4.7
cwe:
  - CWE-601
vendor: sveltejs
product: '@sveltejs/kit'
ecosystem: npm
affected:
  - '@sveltejs/kit < 3.0.0'
patched:
  - '@sveltejs/kit 3.0.0'
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T20:58:25Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-pfhg-q3qv-9q6r'
references:
  - url: 'https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114060'
  - url: >-
      https://github.com/sveltejs/kit/commit/91aae3547c6cd2935d79c09a53e27c740100000a
  - url: 'https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0'
  - url: >-
      https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions
  - url: 'https://github.com/advisories/GHSA-pfhg-q3qv-9q6r'
tags:
  - ghsa
  - npm
  - cve.org
epss: 0.00202
epssPercentile: 0.09987
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-21T14:24:55.358151Z'
ingestedAt: '2026-10-21T01:37:08.047Z'
---

## Overview

### Impact
Applications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, such as catch-all routes, may be vulnerable to an open redirect.

### Patches
A fix has been prepared for `@sveltejs/kit` 3.0.0. Users should upgrade to 3.0.0 or later.

The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.

### Workarounds
Reject requests whose parsed URL pathname begins with `//` before route resolution, for example in a reverse proxy or a SvelteKit `handle` hook.

Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:

```svelte
<form method="POST" use:enhance={() => ({ update }) => update({ navigate: false })}>
  <!-- form fields -->
</form>
```

This applies non-redirect results to the current page instead of navigating to the action location.

## Affected packages

- `@sveltejs/kit < 3.0.0`

## Remediation

Upgrade to a patched release:

- `@sveltejs/kit 3.0.0`