CVE-2026-82256: SvelteKit before 2.69.1 Denial of Service via Remote Form
SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SvelteKit deployments running a version before 2.69.1 are affected. The issue can be reached remotely over the network and does not require authentication or user interaction.
What must an attacker do to cause an outage?
An attacker sends an oversized payload to a remote form function. The insufficient payload-size validation can crash the Node process, and repeated requests can sustain denial of service.
What is the remediation?
Upgrade SvelteKit to version 2.69.1 or later. The provided data does not identify a temporary configuration workaround if upgrading cannot happen immediately.