CVE-2026-82256

mediumpriority · track · 21EPSS 0.004 · 36 %ileUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.42% (36th) EPSS

CVSS 5.3 · medium

Is it mine?

2 products

Check your exposure

Who says so?

2 sources

nvd · osv

EPSS · scored 2026-10-27

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.

cvss

Technical severity, 0–10. One row per scoring source.

6.9

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.7–6.9

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lprimary · disclosure@vulncheck.comexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · OSV

v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · disclosure@vulncheck.com

v4.02.7lowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-248USCWE-400US

affected products (2)

Products and version ranges known to be affected.

svelte sveltekit< 2.69.1nvdUScpe:2.3:a:svelte:sveltekit:*:*:*:*:*:*:*:*
npm @sveltejs/kit< 2.69.1osvUSpkg:npm/%40sveltejs/kit

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-wqjv-9729-c5q2SvelteKit: Big remote form function payloads can cause Node process to crash2026-07-24ghsa · osvUS
Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.

sources

Which sources assert this record, and when.

nvd osv NVD CVE.org MITRE

published 2026-08-28modified 2026-08-31

references (2) nvd

External citations — patches, advisories, analysis.

https://github.com/sveltejs/kit/security/advisories/GHSA-wqjv-9729-c5q2Vendor Advisory
https://www.vulncheck.com/advisories/sveltekit-before-2.69.1-denial-of-service-via-remote-formThird Party Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan