UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128118

Build-time server-only module import guard could fail, resulting in server secrets being statically replaced in client bundle

Severity
High 7.5
Published
29 Oct 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
3.1.1
Weakness
Information exposure (CWE-200)Exposure of a resource to the wrong sphere (CWE-668)
Attack
Over the network · No login needed · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Also known as
GHSA-m9j8-jcmv-hp69
Sources
CVE Program, Project advisories (GitHub)

Description

Under certain circumstances, server-only imports, which typically cannot be included in the client bundle, could make their way into it, potentially exposing secrets. This could only occur when those server-only imports were made through src/params.js.

From sveltejs/kit's security advisory.

Affected software

SoftwareAffected versions
SvelteKitServers and applications · cna:sveltejs|kit
  • From 3.0.0 before 3.1.1
SvelteKitServers and applications · github:sveltejs/kit
  • From 3.0.0 before 3.1.1

References