CVE-2026-82259
SvelteKit 2.49.0 before 2.53.3 Denial of Service via form
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.
| CWE | CWE-502 |
| Vendor | sveltejs |
| Product | kit |
| Published | Aug 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for sveltejs kit
Be the first to know when new high vulnerabilities affecting sveltejs kit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
sveltejs / kit
2.49.0 < 2.53.3
References
Credits
elliott-with-the-longest-name-on-github 🔍 jviide