{"id":"CVE-2026-82259","aliases":["EUVD-2026-67585","GHSA-7jhg-723h-fjhx","GHSA-fpg4-jhqr-589c"],"status":"published","title":"SvelteKit 2.49.0 before 2.53.3 Denial of Service via form","description":"SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00533,"percentile":0.45283,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502","CWE-770"],"published":"2026-02-28T02:04:39Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"npm","package":"@sveltejs/kit","fixed_in":["2.53.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@sveltejs/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.49.0"},{"last_affected":"2.53.2"},{"fixed":"2.53.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@sveltejs/kit","ranges":[{"type":"SEMVER","events":[{"introduced":"2.49.0"},{"fixed":"2.53.3"}]}]}],"products":[{"vendor":"svelte","product":"sveltekit"},{"vendor":"sveltejs","product":"kit"}],"references":[{"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/sveltekit-2.49.0-before-2.53.3-denial-of-service-via-form","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82259","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7jhg-723h-fjhx"},{"url":"https://github.com/sveltejs/kit/commit/faba869db3644077169bf5d7c6e41fd5f3d6c65e","tags":["web"]},{"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.53.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fpg4-jhqr-589c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82259.json","tags":["advisory"]},{"url":"https://github.com/sveltejs/kit","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-82259","title":"SvelteKit 2.49.0 before 2.53.3 Denial of Service via form","description":"SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.","status":"published","published":"2026-08-28T10:49:42.969Z","modified":"2026-10-08T15:25:30.919Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T13:40:46.161838Z"}],"euvd":[{"id":"EUVD-2026-67585","description":"SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.","status":"published","published":"2026-08-28T10:49:42Z","modified":"2026-10-08T15:25:30Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:28.564399Z"}],"ghsa":[{"id":"GHSA-7jhg-723h-fjhx","title":"SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization...","description":"SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.","status":"published","published":"2026-08-28T12:30:29Z","modified":"2026-08-28T12:30:30Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:11:06.970333Z"},{"id":"GHSA-fpg4-jhqr-589c","title":"SvelteKit  has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)","description":"Some relatively small inputs can cause very large files arrays in `form` handlers. If the SvelteKit application code doesn't check `files.length` or individual files' sizes and performs expensive processing with them, it can result in Denial of Service.\n\nOnly users with `experimental.remoteFunctions: true` who are using the `form` function and are processing the `files` array without validation are vulnerable.","status":"published","published":"2026-02-28T02:04:39Z","modified":"2026-02-28T02:04:40Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:39:30.031684Z"}],"nvd":[{"id":"CVE-2026-82259","description":"SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.","status":"published","published":"2026-08-28T12:16:38.953Z","modified":"2026-10-08T16:17:48.623Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"CVE-2026-82259","title":"SvelteKit 2.49.0 before 2.53.3 Denial of Service via form","description":"SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.","status":"published","published":"2026-08-28T10:49:42.969Z","modified":"2026-10-28T02:31:09.332316573Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"GHSA-fpg4-jhqr-589c","title":"SvelteKit  has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)","description":"Some relatively small inputs can cause very large files arrays in `form` handlers. If the SvelteKit application code doesn't check `files.length` or individual files' sizes and performs expensive processing with them, it can result in Denial of Service.\n\nOnly users with `experimental.remoteFunctions: true` who are using the `form` function and are processing the `files` array without validation are vulnerable.","status":"published","published":"2026-02-28T02:04:39Z","modified":"2026-08-29T03:55:36.168482178Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}