Skip to main content

SvelteKit CVE-2026-82256

| EUVDEUVD-2026-67582 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-08-28 VulnCheck GHSA-qcf5-5x72-5253
Denial Of Service Kit
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable with no privileges or user interaction required; impact is confined to low availability via process crash with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 28, 2026 - 13:17 EUVD
Source Code Evidence Fetched
Aug 28, 2026 - 12:15 vuln.today
Analysis Generated
Aug 28, 2026 - 12:15 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on @sveltejs/kit (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.69.1.

DescriptionCVE.org

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.

AnalysisAI

Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers to crash the underlying Node.js process by submitting oversized POST payloads. All @sveltejs/kit versions prior to 2.69.1 are affected; no authentication or special configuration is required to trigger the crash. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The application must run @sveltejs/kit version 2.69.0 or earlier and must expose at least one form action endpoint reachable over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) reflects low availability impact to the vulnerable system, with zero confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade @sveltejs/kit to version 2.69.1 or later, which incorporates the fix from commit 82b0370c793ac392cee5c2e28f4b8fed09c64582 (PR #16219). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Kit

View all
CVE-2024-23641 HIGH POC
7.5 Jan 24

SvelteKit is a web development kit. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authe
CVE-2025-67647 CRITICAL
9.1 Jan 15

SvelteKit 2.19.0-2.49.4 has SSRF/DoS affecting applications with prerendered routes. Can be exploited to make the server
CVE-2026-82261 HIGH
8.7 Aug 28

CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers

CVE-2026-82260 HIGH
8.7 Aug 28

Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the s
CVE-2026-82259 HIGH
8.7 Aug 28

Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who subm
CVE-2026-40073 HIGH
8.2 Apr 10

Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads,

CVE-2026-22803 HIGH
7.5 Jan 15

SvelteKit versions 2.49.0 through 2.49.4 are vulnerable to denial-of-service attacks through the experimental form remot
CVE-2026-40074 MEDIUM
6.3 Apr 10

SvelteKit versions prior to 2.57.1 are vulnerable to denial of service when the redirect() function is called from the h
CVE-2026-82258 MEDIUM
5.9 Aug 28

Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition i
CVE-2026-82257 MEDIUM
5.3 Aug 28

Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from Java
CVE-2026-66062 MEDIUM POC
5.3 Aug 07

Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-82256 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy