GHSA-88qp-p4qg-rqm6

ghsaUSosv

CPU exhaustion in SvelteKit remote form deserialization (experimental only)

view advisory published 2026-02-19Licence: CC-BY-4.0

Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service. Only applications using both `experimental.remoteFunctions` and `form` are vulnerable.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-82261US	high7.5	0.49% (42nd)	—	2026-08-28
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An atta…

references

External citations — patches, advisories, analysis.

https://github.com/sveltejs/kitPACKAGE
https://github.com/sveltejs/kit/commit/3e607b314aec9e5f278d32847945b8b6323e1cb8WEB
https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2WEB
https://github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan