CVE-2026-82261
CVE-2026-82261 · SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.
CVSS 8.7 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
kit
- Versions
- ≥ 2.49.0, < 2.52.1: Affected (semver)
- 2.52.1: Not affected (semver)
Update to 2.52.1
@sveltejs/kit npm
- Affected ranges
- SEMVER: ≥ 2.49.0, < 2.52.2
Update to 2.52.2