PT-2026-83113 · Sveltekit · Sveltekit

Elliott-With-The-Longest-Name-On-Github

·

CVE-2026-82261

·

Published

2026-02-19

·

Updated

2026-08-28

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1
Description When experimental remote functions and form are enabled, a CPU exhaustion issue exists during form deserialization. An attacker can send malformed form data to make the server unresponsive during request processing, leading to a denial of service.
Recommendations Update SvelteKit (@sveltejs/kit) to version 2.52.2.

Exploit

Fix

DoS

Resource Exhaustion

Type Confusion

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-400CWE-843

Related Identifiers

CVE-2026-82261
GHSA-88QP-P4QG-RQM6

Affected Products

Sveltekit