High severity7.5NVD Advisory· Published Aug 28, 2026· Updated Aug 31, 2026
CVE-2026-82261
CVE-2026-82261
Description
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6nvdVendor Advisory
- www.vulncheck.com/advisories/sveltekit-before-2.52.2-cpu-exhaustion-via-remote-form-deserializationnvdThird Party Advisory
News mentions
0No linked articles in our index yet.