CVE-2026-82260: SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SvelteKit (@sveltejs/kit)to a version that resolves this vulnerability.Fixed in 2.52.2 - Configuration
If you are on a version >=2.49.0 and <=2.52.1, disable experimental remote functions (experimental.remoteFunctions) and/or remote form functionality with form enabled, because remote form deserialization is vulnerable in this range until upgrading to 2.52.2.
SvelteKit (@sveltejs/kit) experimental.remoteFunctions = enabled (experimental remote functions) and form enabled
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use @sveltejs/kit versions 2.49.0 through 2.52.1 and have both experimental.remoteFunctions and form enabled. Deployments outside that version range or without those features enabled are not identified as affected by the provided advisory.
What does an attacker need to exploit this issue?
An attacker can send malformed form data to trigger excessive memory allocation during remote form deserialization. The supplied vector indicates network exploitation with low complexity, no privileges, and no user interaction required.
What is the impact of successful exploitation?
Exploitation can exhaust memory and crash the server process, causing denial of service. The provided severity vector identifies availability impact only, with no indicated confidentiality or integrity impact.
What should be done to remediate the issue?
Upgrade @sveltejs/kit to version 2.52.2, which contains the fix. If an immediate upgrade is not possible, the provided data identifies experimental remote functions and forms as the affected feature combination.