CVE-2025-62381
CVE-2025-62381 · sveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`
This page contains facts from public vulnerability sources. Check the original advisory before updating.
sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4.
CVSS 8.3 · High · EPSS 0.7% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
sveltekit-superforms
- Versions
- < 2.27.4: Affected
No fix published
sveltekit-superforms npm
- Affected ranges
- SEMVER: < 2.27.4
Update to 2.27.4