Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-128118— SvelteKit: Build-time server-only module import guard could fail, resulting in server secrets being statically replaced in client bundle

Quick assessment

Affected
sveltejs kit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SvelteKit 是一个基于 Svelte 的框架，用于快速开发健壮且高性能的 Web 应用。在 3.0.0 至 3.1.1 版本之间，构建时的服务器专用模块保护机制未将 视为客户端入口点，尽管参数匹配器（parameter matchers）可能在浏览器中运行。因此，通过 导入的服务器专用模块可能被包含进客户端打包文件中，从而导致静态替换的私有环境变量值或其他服务器机密信息泄露。该问题已在 3.1.1 版本中修复。

CVSS 7.5 · High EPSS 0.28% · P21

Affected Version Matrix 1

VendorProduct Version RangeStatus
sveltejs kit >= 3.0.0, < 3.1.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-128118

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SvelteKit: Build-time server-only module import guard could fail, resulting in server secrets being statically replaced in client bundle
Source: CVE Program / CVE List V5
Vulnerability Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 until 3.1.1, the build-time server-only module guard did not treat src/params.js as a client entry point even though parameter matchers can run in the browser. Server-only modules imported through src/params.js could consequently enter the client bundle, where statically replaced private environment values or other server secrets could be exposed. This issue is fixed in 3.1.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sveltejs kit >= 3.0.0, < 3.1.1 -

II. Public POCs for CVE-2026-128118

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-128118

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-128118 (1)

Vendor Advisories for CVE-2026-128118 (1)

Vendor Pages for CVE-2026-128118 (1)

Same Patch Batch · sveltejs · 2026-11-13 · 8 CVEs total

CVE-2026-128120 7.5 HIGH SvelteKit: DoS while parsing form data from a remote functions `form`
CVE-2026-128119 5.9 MEDIUM SvelteKit: Private `query.batch` functions could collide, producing unexpected parameter /
CVE-2026-128122 5.9 MEDIUM SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` fil
CVE-2026-128123 5.9 MEDIUM SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`
CVE-2026-128117 5.9 MEDIUM SvelteKit: Unhandled URIError when `reroute` rewrites a malformed pathname crashes adapter
CVE-2026-128121 5.9 MEDIUM SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config
CVE-2026-128116 5.3 MEDIUM SvelteKit: Protocol-relative module import during server-side route resolution allows cros

IV. Related Vulnerabilities

Same product: kit
Same vendor: sveltejs
Same weakness: CWE-200