CVE-2026-82260

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
sveltejs	kit	>= 2.49.0, < 2.52.1

References

https://github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcfVendor Advisory
https://www.vulncheck.com/advisories/sveltekit-before-2.52.2-memory-exhaustion-via-remote-form-deserializationThird Party Advisory

Timeline

Published: Aug 28, 2026
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-822617.5SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulner CVE-2026-822626.8Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary UR CVE-2026-822636.8Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate CVE-2026-822646.8Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from CVE-2026-822656.5Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attacke CVE-2026-822669.8Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated reques CVE-2026-822675.4Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute an CVE-2026-822687.5Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied path CVE-2026-822698.1Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers wit CVE-2026-82278.8A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manip CVE-2026-822707.5Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator CVE-2026-822716.5R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to mod