CVE-2026-114061

### Impact Applications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS). SvelteKit inserts the header value into a `<meta http-equiv="cache-control">` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page. ### Patches The fix escapes the header value before inserting it into the generated HTML. Upgrade to `@sveltejs/kit` version 3.0.0 or later. ### Workarounds Avoid forwarding untrusted `cache-control` header values with `setHeaders` on prerendered pages. Use a fixed, trusted cache policy instead.