HIGH🇵🇱 Wersja polska

CVE-2026-82259

CVSS 8.7v4.0pub. 2026-08-28upd. 2026-08-31

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Svelte Sveltekit

    APP
    Svelte
    2.49.0 – 2.53.3 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
DoSDeserialization
CWE
References

Related vulnerabilities

CVE-2026-82260HIGH8.7same product

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remo...

CVE-2026-82261HIGH8.7same product

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled c...

CVE-2023-29008HIGH8.8same product

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+s...

CVE-2023-29003HIGH8.8same product

SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple...

CVE-2026-82256MEDIUM6.9same product

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to c...