CVE-2026-82261

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...

CVE-2026-82260

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions experimental.remoteFunctions and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process an...

CVE-2026-82259

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

EUVD-2026-67587

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...

CVE-2026-82261 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...

CVE-2026-82261

SvelteKit (@sveltejs/kit) versions >=2.49.0 and

CVE-2026-82261 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...

EUVD-2026-67586

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions experimental.remoteFunctions and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process an...

CVE-2026-82260 SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions experimental.remoteFunctions and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process an...

CVE-2026-82260

SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 with the experimental remoteFunctions and form features enabled are vulnerable to memory exhaustion in remote form deserialization. Malformed form data triggers excessive memory allocation, crashing the server process and causing a denial o...

CVE-2026-82260: Uncontrolled Resource Consumption

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions experimental.remoteFunctions and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process an...

CVE-2026-82261: Uncontrolled Resource Consumption

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...

PT-2026-83113

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...

PT-2026-83111

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

PT-2026-83112

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions experimental.remoteFunctions and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process an...

Allocation of Resources Without Limits or Throttling

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the deserializebinaryform function in the remote form handler. An attacker can exhaust application resources by sending crafted bina...

SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)

Some relatively small inputs can cause very large files arrays in form handlers. If the SvelteKit application code doesn't check files.length or individual files' sizes and performs expensive processing with them, it can result in Denial of Service. Only users with experimental.remoteFunctions:...

GHSA-FPG4-JHQR-589C SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)

Some relatively small inputs can cause very large files arrays in form handlers. If the SvelteKit application code doesn't check files.length or individual files' sizes and performs expensive processing with them, it can result in Denial of Service. Only users with experimental.remoteFunctions:...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the remote form deserialization. An attacker can cause the server to become unresponsive and exhaust CPU resources by...

CPU exhaustion in SvelteKit remote form deserialization (experimental only)

Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service. Only applications using both experimental.remoteFunctions and form...