From d727f8b5b5898f289fb89dffd2295c91fb252a70 Mon Sep 17 00:00:00 2001
From: Nic Polumeyv <162764842+Nic-Polumeyv@users.noreply.github.com>
Date: Sat, 1 Aug 2026 17:47:02 -0400
Subject: [PATCH] guard getSetCookie like get

---
 .changeset/quick-cookies-guarded.md               |  5 +++++
 packages/kit/src/runtime/server/page/load_data.js | 15 +++++++++++++++
 .../kit/src/runtime/server/page/load_data.spec.js | 12 ++++++++++++
 3 files changed, 32 insertions(+)
 create mode 100644 .changeset/quick-cookies-guarded.md

diff --git a/.changeset/quick-cookies-guarded.md b/.changeset/quick-cookies-guarded.md
new file mode 100644
index 000000000000..fd2dd735afc2
--- /dev/null
+++ b/.changeset/quick-cookies-guarded.md
@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: error when reading non-serialized `set-cookie` headers via `getSetCookie` in `load`
diff --git a/packages/kit/src/runtime/server/page/load_data.js b/packages/kit/src/runtime/server/page/load_data.js
index 67c9c3c37c07..d1b6956788ca 100644
--- a/packages/kit/src/runtime/server/page/load_data.js
+++ b/packages/kit/src/runtime/server/page/load_data.js
@@ -482,6 +482,21 @@ export function create_universal_fetch(event, state, fetched, csr, resolve_opts)
 
 				return value;
 			};
+
+			const get_set_cookie = response.headers.getSetCookie;
+			response.headers.getSetCookie = () => {
+				const values = get_set_cookie.call(response.headers);
+				for (const value of values) {
+					const included = resolve_opts.filterSerializedResponseHeaders('set-cookie', value);
+					if (!included) {
+						throw new Error(
+							`Failed to get response header "set-cookie" — it must be included by the \`filterSerializedResponseHeaders\` option: https://svelte.dev/docs/kit/hooks#handle (at ${event.route.id})`
+						);
+					}
+				}
+
+				return values;
+			};
 		}
 
 		return proxy;
diff --git a/packages/kit/src/runtime/server/page/load_data.spec.js b/packages/kit/src/runtime/server/page/load_data.spec.js
index 1e611442b235..a2c143d61c37 100644
--- a/packages/kit/src/runtime/server/page/load_data.spec.js
+++ b/packages/kit/src/runtime/server/page/load_data.spec.js
@@ -73,3 +73,15 @@ test('errors when trying to access non-serialized request headers on the server'
 		/Failed to get response header "content-type" — it must be included by the `filterSerializedResponseHeaders` option/
 	);
 });
+
+test('errors when trying to access non-serialized set-cookie headers on the server', async () => {
+	const fetch = create_fetch({
+		// eslint-disable-next-line @typescript-eslint/require-await
+		fetch: async () => new Response('foo', { headers: { 'set-cookie': 'a=1' } })
+	});
+	const response = await fetch('https://domain-a.com');
+	assert.throws(
+		() => response.headers.getSetCookie(),
+		/Failed to get response header "set-cookie" — it must be included by the `filterSerializedResponseHeaders` option/
+	);
+});