CVE-2026-82256
CVE-2026-82256 · SvelteKit before 2.69.1 Denial of Service via Remote Form
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.
CVSS 6.9 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
kit
- Versions
- ≥ 0, < 2.69.1: Affected (semver)
- 2.69.1: Not affected (semver)
Update to 2.69.1
@sveltejs/kit npm
- Affected ranges
- SEMVER: < 2.69.1
Update to 2.69.1