SvelteKit: Big remote form function payloads can cause Node process to crash

Description

References

• sveltejs/kit security advisory · WEB
• sveltejs/kit#16219 · WEB
• sveltejs/kit commit 82b0370 · WEB
• sveltejs/kit · PACKAGE
• sveltejs/kit release @sveltejs · WEB
• sveltejs/kit release @sveltejs · WEB
• vulncheck.com/advisories/sveltekit-before-2.69.1-denial-of-service-via-remote-form · Third Party Advisory

Weitere Schwachstellen in sveltekit

• CVE-2026-82261HOCH 7.5SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulner…
• CVE-2026-82260HOCH 7.5SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled …
• CVE-2026-82259HOCH 7.5SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote fu…
• CVE-2026-82258MITTEL 4.8SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to…
• CVE-2026-82257MITTEL 4.3SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arb…