Skip to content
OpenAdvisories
High · 7.5 CVE-2026-128118 EUVD-2026-125730

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 until 3.1.1, the build…

Published Nov 13, 2026 · Assigned by GitHub_M

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 until 3.1.1, the build-time server-only module guard did not treat src/params.js as a client entry point even though parameter matchers can run in the browser. Server-only modules imported through src/params.js could consequently enter the client bundle, where statically replaced private environment values or other server secrets could be exposed. This issue is fixed in 3.1.1.

Affected products

VendorProductAffectedFixed
sveltejs kit 3.0.0, < 3.1.1 —

References