What’s Vulnerable › Vulnerabilities

CVE-2026-82259: SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-28 · updated 2026-10-08
• Weakness: CWE-502

Description

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.

Affected products

• sveltejs kit: from 2.49.0 before 2.53.3 — fixed in 2.53.3

How to fix

Upgrade to a fixed version: sveltejs kit 2.53.3. Check the vendor advisory for mitigations.

References

• https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c
• https://www.vulncheck.com/advisories/sveltekit-2.49.0-before-2.53.3-denial-of-service-via-form

Get alerted when CVE-2026-82259 or the next vulnerability affects your stack