SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because…
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Node.js
- Product
- Node.js
- CVSS
- 5.3
- Exposure class
- Developer platform
Why it ranks 8 (Routine)
- CVSS 5.3 medium
- Product class: developer platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.