CVE-2026-114061Published

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An …

Exact source revision recorded 25 Oct 2026 05:17:18 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

Immutable source observations

1 recorded revisions

Each citation identifies one complete source statement. Source modification dates and the time this installation observed them are distinct. Latest history includes records historically associated by source identifiers; a removed alias is not a current equivalence claim. Exact citations show that source record's own earlier observations. Failed reads and unchanged polls do not rewrite history.

25 Oct 2026 05:17:18 UTC

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An …

nvd · CVE-2026-114061 · Published

This citation shows only its exact record and strictly earlier observation times. Open complete latest history.