CVE-2026-128120: SvelteKit: DoS while parsing form data from a remote functions `form`
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.42.0 until 3.1.1, applications using the experimental remote functions flag and a remote form function could perform quadratic synchronous work while parsing a specially crafted request with many form entries. The parsing work could block the event loop for an extended period and deny service. This issue is fixed in 3.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.1.1
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service issue?
Applications using @sveltejs/kit from version 2.42.0 through versions before 3.1.1 are affected only if they enable the experimental remote functions flag and use a remote form function.
What does an attacker need to exploit the issue?
An attacker can send a specially crafted request containing many form entries. No authentication or user interaction is required according to the supplied CVSS vector.
What is the operational impact of a successful attack?
Parsing the crafted form data can cause quadratic synchronous work, blocking the event loop for an extended period. This can deny service to the affected application.
What should teams do to remediate the issue?
Upgrade @sveltejs/kit to version 3.1.1, which fixes the issue. If upgrading is not immediately possible, the provided information does not identify a workaround.