CVE-2026-82261 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization

What is CVE-2026-82261?

CVE-2026-82261 is a high-severity denial of service vulnerability in sveltejs kit, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.

Weakness: CWE-400

Which versions are affected by CVE-2026-82261?

2 open source packages ship an affected version, including @sveltejs/kit. It affects 1 product.

Products include Svelte Sveltekit.

How do I fix CVE-2026-82261?

Upgrade @sveltejs/kit to 2.52.2 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-82261 being exploited?

There is no known exploitation of CVE-2026-82261 in the wild and no public exploit code.

Other vulnerabilities in sveltejs kit

• CVE-2023-29008 SvelteKit framework has Insufficient CSRF protection for CORS requests High 8.8
• CVE-2023-29003 SvelteKit has Insufficient Cross-Site Request Forgery Protection High 8.8
• CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form High 8.7
• CVE-2026-82260 SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization High 8.7
• CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-88qp-p4qg-rqm6, GHSA-xjpx-7387-jh7h.