CVE-2026-128120

Name of the Vulnerable Software and Affected Versions SvelteKit versions 2.42.0 through 3.1.0

Description Applications using the experimental remote functions flag and a remote form function are susceptible to a denial of service. A specially crafted request containing numerous form entries can trigger quadratic synchronous work during parsing, which blocks the event loop for an extended period.

Recommendations Update to version 3.1.1.