SvelteKit: Big remote form function payloads can cause Node process to crash

中危 5.3CVE-2026-82256 · GHSA-wqjv-9729-c5q2 · Published 28/08/2026 · updated 08/10/2026

要点

CVE-2026-82256 是影响 sveltekit (svelte), @sveltejs/kit 的中危 (CVSS 5.3)漏洞。
未来 30 天内被利用的概率（EPSS）：0.42%，高于 36.6% 的漏洞。
修复：升级到 2.69.1 或更高版本。

Package	Affected versions	Patched versions
sveltekit svelte	`< 2.69.1`	`2.69.1`
@sveltejs/kit npm	`< 2.69.1`	`2.69.1`

Description

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.

NVD description

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.

References

sveltejs/kit security advisory · WEB
sveltejs/kit#16219 · WEB
sveltejs/kit commit 82b0370 · WEB
sveltejs/kit · PACKAGE
sveltejs/kit release @sveltejs · WEB
sveltejs/kit release @sveltejs · WEB
vulncheck.com/advisories/sveltekit-before-2.69.1-denial-of-service-via-remote-form · Third Party Advisory

sveltekit 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

sveltekit

svelte

< 2.69.1

2.69.1

@sveltejs/kit

npm

< 2.69.1

2.69.1

Description

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.

NVD description

sveltekit 的其他漏洞

查看全部 →