CVE-2026-82260
CVE-2026-82260 · SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.
CVSS 8.7 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
kit
- Versions
- ≥ 2.49.0, < 2.52.1: Affected (semver)
- 2.52.1: Not affected (semver)
Update to 2.52.1
@sveltejs/kit npm
- Affected ranges
- SEMVER: ≥ 2.49.0, < 2.52.2
Update to 2.52.2