CVE-2026-82261: SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SvelteKit (@sveltejs/kit)to a version that resolves this vulnerability.Fixed in 2.52.2
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use @sveltejs/kit versions 2.49.0 through 2.52.1 and have experimental remote functions with form support enabled.
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely without authentication or user interaction by sending malformed form data to a vulnerable server.
What is the operational impact?
Processing malformed form data can exhaust CPU resources and make the server unresponsive, causing denial of service. The provided severity vector indicates no confidentiality or integrity impact.
What should be done to remediate the issue?
Upgrade @sveltejs/kit to version 2.52.2, which fixes the vulnerability.