CVE-2026-82256

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

CVE-2026-82257

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application...

CVE-2026-82260 SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions experimental.remoteFunctions and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process an...

CVE-2026-82257 SvelteKit before 2.69.1 Prototype Pollution via File Input

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application...

CVE-2026-82257 SvelteKit before 2.69.1 Prototype Pollution via File Input

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application...

EUVD-2026-67583

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application...

CVE-2026-82257 SvelteKit before 2.69.1 Prototype Pollution via File Input

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application...

CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

CVE-2026-82256

SvelteKit versions prior to 2.69.1 contain a denial-of-service vulnerability in its remote form function handling. The root cause is a failure to properly validate payload sizes, allowing an unauthenticated network attacker to crash the Node process by sending abnormally large payloads. Repeated ...

CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

EUVD-2026-67582

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

CVE-2026-82256: Uncontrolled Resource Consumption

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

PT-2026-83109

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application...

PT-2026-83112

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions experimental.remoteFunctions and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process an...

GHSA-866W-XMHQ-WJ7X SvelteKit: Prototype pollution in file input deletion path in remote-function forms

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype...

GHSA-WQJV-9729-C5Q2 SvelteKit: Big remote form function payloads can cause Node process to crash

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS...

SvelteKit: Big remote form function payloads can cause Node process to crash

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS...

PT-2026-67475

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype...

PT-2026-83108

Name of the Vulnerable Software and Affected Versions SvelteKit versions prior to 2.69.1 Description Insufficient validation of remote form function payload sizes allows an attacker to crash the Node process by sending excessively large payloads. Repeated exploitation of this issue leads to a...