CVE-2026-22803
High · 7.5@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)
CVSS
7.5
EPSS
0.6%
Published
Jan 15, 2026
CISA due date
—
The record
The experimental `form` remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @sveltejs/kit | 2.49.0 | 2.49.5 |
Related vulnerabilities
- GHSA-j2f3-wq62-6q46 @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form… Same vulnerability
- GHSA-hgv7-v322-mmgr @sveltejs/kit: `query.batch` cross-talk Also affects @sveltejs/kit
- GHSA-3f6h-2hrp-w5wx @sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service Also affects @sveltejs/kit
- GHSA-2crg-3p73-43xp @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass Also affects @sveltejs/kit
- CVE-2026-40073 SvelteKit is a framework for rapidly developing robust, performant web applications using… Also affects @sveltejs/kit
- CVE-2026-40074 SvelteKit is a framework for rapidly developing robust, performant web applications using… Also affects @sveltejs/kit
- GHSA-fpg4-jhqr-589c SvelteKit has deserialization expansion in unvalidated `form` remote function leading to… Also affects @sveltejs/kit
- GHSA-88qp-p4qg-rqm6 CPU exhaustion in SvelteKit remote form deserialization (experimental only) Also affects @sveltejs/kit