CVE-2026-22803

CVE-2026-22803 affects SvelteKit. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary format for submitted data, and a crafted payload can trigger unbounded memory allocation, causing a DoS via memory exhaustion. This is fixed in 2.49.5. Impact is memory exhaustion of the s...