p PatchFirst

CVE-2026-22803

CVE-2026-22803 · SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer

This page contains facts from public vulnerability sources. Check the original advisory before updating.

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.

CVSS 8.2 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • kit

    Versions
    • >= 2.49.0, < 2.49.5: Affected

    No fix published

  • @sveltejs/kit npm

    Affected ranges
    • SEMVER: ≥ 2.49.0, < 2.49.5

    Update to 2.49.5

Original sources

Check your server →