CVE-2026-82260 SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization

What is CVE-2026-82260?

CVE-2026-82260 is a high-severity denial of service vulnerability in sveltejs kit, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.

Weakness: CWE-400

Which versions are affected by CVE-2026-82260?

2 open source packages ship an affected version, including @sveltejs/kit. It affects 1 product.

Products include Svelte Sveltekit.

How do I fix CVE-2026-82260?

Upgrade @sveltejs/kit to 2.52.2 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-82260 being exploited?

There is no known exploitation of CVE-2026-82260 in the wild and no public exploit code.

Other vulnerabilities in sveltejs kit

• CVE-2023-29008 SvelteKit framework has Insufficient CSRF protection for CORS requests High 8.8
• CVE-2023-29003 SvelteKit has Insufficient Cross-Site Request Forgery Protection High 8.8
• CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form High 8.7
• CVE-2026-82261 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization High 8.7
• CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-33c7-c62f-7cc2, GHSA-vrhm-gvg7-fpcf.