CVE-2026-82256: medium-severity vulnerability in sveltejs kit
SvelteKit before 2.69.1 Denial of Service via Remote Form
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.4%
SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
sveltejs · kitRelated CVEs — sveltejs kit
In the same product, most dangerous first.
CVE-2024-23641HIGHSending a GET or HEAD request with a body crashes SvelteKitEPSS 0.8%CVE-2025-67647HIGHSvelteKit Denial of service and possible SSRF when using prerenderingEPSS 0.6%CVE-2026-22803HIGHSvelteKit has a memory amplification DoS in Remote Functions binary form deserializerEPSS 0.6%CVE-2023-29003HIGHSvelteKit has Insufficient Cross-Site Request Forgery ProtectionEPSS 0.6%CVE-2026-40073HIGHSvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-nodeEPSS 0.5%CVE-2026-82259HIGHSvelteKit 2.49.0 before 2.53.3 Denial of Service via formEPSS 0.5%