{"id":"CVE-2026-82260","aliases":["EUVD-2026-67586","GHSA-33c7-c62f-7cc2","GHSA-vrhm-gvg7-fpcf"],"status":"published","title":"SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization","description":"SvelteKit (@sveltejs/kit) versions \u003e=2.49.0 and \u003c=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00493,"percentile":0.42824,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2026-02-19T20:29:42Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"npm","package":"@sveltejs/kit","fixed_in":["2.52.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@sveltejs/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.49.0"},{"last_affected":"2.52.1"},{"fixed":"2.52.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@sveltejs/kit","ranges":[{"type":"SEMVER","events":[{"introduced":"2.49.0"},{"fixed":"2.52.2"}]}]}],"products":[{"vendor":"svelte","product":"sveltekit"},{"vendor":"sveltejs","product":"kit"}],"references":[{"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcf","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/sveltekit-before-2.52.2-memory-exhaustion-via-remote-form-deserialization","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82260","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-33c7-c62f-7cc2"},{"url":"https://github.com/sveltejs/kit/commit/f47c01bd8100328c24fdb8522fe35913b0735f35","tags":["web"]},{"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vrhm-gvg7-fpcf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82260.json","tags":["advisory"]},{"url":"https://github.com/sveltejs/kit","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-82260","title":"SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization","description":"SvelteKit (@sveltejs/kit) versions \u003e=2.49.0 and \u003c=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.","status":"published","published":"2026-08-28T10:49:43.651Z","modified":"2026-10-08T15:25:31.482Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-67586","description":"SvelteKit (@sveltejs/kit) versions \u003e=2.49.0 and \u003c=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.","status":"published","published":"2026-08-28T10:49:43Z","modified":"2026-10-08T15:25:31Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:28.564399Z"}],"ghsa":[{"id":"GHSA-33c7-c62f-7cc2","title":"SvelteKit (@sveltejs/kit) versions \u003e=2.49.0 and \u003c=2.52.1 with experimental remote functions ...","description":"SvelteKit (@sveltejs/kit) versions \u003e=2.49.0 and \u003c=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.","status":"published","published":"2026-08-28T12:30:29Z","modified":"2026-08-28T12:30:36Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:11:06.970333Z"},{"id":"GHSA-vrhm-gvg7-fpcf","title":" Memory exhaustion in SvelteKit remote form deserialization (experimental only)","description":"Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.\n\nOnly applications using both `experimental.remoteFunctions` and `form` are vulnerable.","status":"published","published":"2026-02-19T20:29:42Z","modified":"2026-02-19T20:29:43Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:39:25.82905Z"}],"nvd":[{"id":"CVE-2026-82260","description":"SvelteKit (@sveltejs/kit) versions \u003e=2.49.0 and \u003c=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.","status":"published","published":"2026-08-28T12:16:39.1Z","modified":"2026-10-08T16:17:48.803Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"CVE-2026-82260","title":"SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization","description":"SvelteKit (@sveltejs/kit) versions \u003e=2.49.0 and \u003c=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.","status":"published","published":"2026-08-28T10:49:43.651Z","modified":"2026-10-28T02:30:33.183105574Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"GHSA-vrhm-gvg7-fpcf","title":" Memory exhaustion in SvelteKit remote form deserialization (experimental only)","description":"Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.\n\nOnly applications using both `experimental.remoteFunctions` and `form` are vulnerable.","status":"published","published":"2026-02-19T20:29:42Z","modified":"2026-09-02T03:55:42.139843995Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:57.694388Z"}]}}