CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

High 8.7 Published 28 Aug 2026 Updated 8 Oct 2026

Attackers can cause denial of service in SvelteKit applications by exploiting deserialization expansion in experimental remote form functions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-82259?

CVE-2026-82259 is a high-severity denial of service vulnerability in sveltejs kit, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.

Weakness: CWE-502

Which versions are affected by CVE-2026-82259?

2 open source packages ship an affected version, including @sveltejs/kit. It affects 1 product.

Package	Affected	Fixed in
`@sveltejs/kit` npm	From `2.49.0`	`2.53.3`
`@sveltejs/kit` npm	From `2.49.0`	`2.53.3`

Products include Svelte Sveltekit.

How do I fix CVE-2026-82259?

Upgrade @sveltejs/kit to 2.53.3 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-82259 being exploited?

There is no known exploitation of CVE-2026-82259 in the wild and no public exploit code.

Sources

Also known as GHSA-7jhg-723h-fjhx, GHSA-fpg4-jhqr-589c.