CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form

What is CVE-2026-82256?

CVE-2026-82256 is a medium-severity denial of service vulnerability in sveltejs kit, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.

Weakness: CWE-400

Which versions are affected by CVE-2026-82256?

2 open source packages ship an affected version, including @sveltejs/kit. It affects 1 product.

Products include Svelte Sveltekit.

How do I fix CVE-2026-82256?

Upgrade @sveltejs/kit to 2.69.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-82256 being exploited?

There is no known exploitation of CVE-2026-82256 in the wild and no public exploit code.

Other vulnerabilities in sveltejs kit

• CVE-2023-29008 SvelteKit framework has Insufficient CSRF protection for CORS requests High 8.8
• CVE-2023-29003 SvelteKit has Insufficient Cross-Site Request Forgery Protection High 8.8
• CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form High 8.7
• CVE-2026-82260 SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization High 8.7
• CVE-2026-82261 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-qcf5-5x72-5253, GHSA-wqjv-9729-c5q2.