GHSA-fpg4-jhqr-589c
NoneCVSS
—
EPSS
—
Published
Feb 28, 2026
CISA due date
—
The record
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @sveltejs/kit | 2.49.0 | 2.53.3 |
Related vulnerabilities
- GHSA-hgv7-v322-mmgr @sveltejs/kit: `query.batch` cross-talk Also affects @sveltejs/kit
- GHSA-3f6h-2hrp-w5wx @sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service Also affects @sveltejs/kit
- GHSA-2crg-3p73-43xp @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass Also affects @sveltejs/kit
- CVE-2026-40073 SvelteKit is a framework for rapidly developing robust, performant web applications using… Also affects @sveltejs/kit
- CVE-2026-40074 SvelteKit is a framework for rapidly developing robust, performant web applications using… Also affects @sveltejs/kit
- GHSA-88qp-p4qg-rqm6 CPU exhaustion in SvelteKit remote form deserialization (experimental only) Also affects @sveltejs/kit
- GHSA-vrhm-gvg7-fpcf Memory exhaustion in SvelteKit remote form deserialization (experimental only) Also affects @sveltejs/kit
- GHSA-j2f3-wq62-6q46 @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form… Also affects @sveltejs/kit