SvelteKit: Big remote form function payloads can cause Node process to crash

MEDIUM 5.3CVE-2026-82256 · GHSA-wqjv-9729-c5q2 · Published 28/08/2026 · updated 08/10/2026

In short

CVE-2026-82256 is a MEDIUM (CVSS 5.3) vulnerability affecting sveltekit (svelte), @sveltejs/kit.
Chance of exploitation in the next 30 days (EPSS): 0.42%, higher than 36.6% of all vulnerabilities.
Fix: update to 2.69.1 or later.

Package	Affected versions	Patched versions
sveltekit svelte	`< 2.69.1`	`2.69.1`
@sveltejs/kit npm	`< 2.69.1`	`2.69.1`

Description

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.

NVD description

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.

References

sveltejs/kit security advisory · WEB
sveltejs/kit#16219 · WEB
sveltejs/kit commit 82b0370 · WEB
sveltejs/kit · PACKAGE
sveltejs/kit release @sveltejs · WEB
sveltejs/kit release @sveltejs · WEB
vulncheck.com/advisories/sveltekit-before-2.69.1-denial-of-service-via-remote-form · Third Party Advisory

More vulnerabilities in sveltekit

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

sveltekit

svelte

< 2.69.1

2.69.1

@sveltejs/kit

npm

< 2.69.1

2.69.1

Description

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.

NVD description

More vulnerabilities in sveltekit

See all →