Kit
CVE-2026-22803
HIGH
GHSA-j2f3-wq62-6q46
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 npm packages depend on @sveltejs/kit (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.49.0.
DescriptionGitHub Advisory
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.
AnalysisAI
SvelteKit versions 2.49.0 through 2.49.4 are vulnerable to denial-of-service attacks through the experimental form remote function, which fails to properly validate binary-encoded form payloads and can be exploited to exhaust server memory. An unauthenticated remote attacker can craft a malicious payload to trigger excessive memory allocation, rendering affected applications unavailable. The vulnerability is resolved in version 2.49.5.
Technical ContextAI
Affects Kit. SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 2.49.5.. Restrict network access to the affected service where possible.
SvelteKit is a web development kit. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authe
SvelteKit 2.19.0-2.49.4 has SSRF/DoS affecting applications with prerendered routes. Can be exploited to make the server
CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers
Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the s
Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who subm
Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads,
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers
SvelteKit versions prior to 2.57.1 are vulnerable to denial of service when the redirect() function is called from the h
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition i
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from Java
Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today