Vulnerability Description
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Svelte | Sveltekit | >= 2.49.0, < 2.52.2 |
Related Weaknesses (CWE)
References
- https://github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6Vendor Advisory
- https://www.vulncheck.com/advisories/sveltekit-before-2.52.2-cpu-exhaustion-via-Third Party Advisory
FAQ
What is CVE-2026-82261?
CVE-2026-82261 is a vulnerability with a CVSS score of 7.5 (HIGH). SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malfor...
How severe is CVE-2026-82261?
CVE-2026-82261 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82261?
Check the references section above for vendor advisories and patch information. Affected products include: Svelte Sveltekit.