EUVD-2026-67587
GHSA-xjpx-7387-jh7h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify SvelteKit app with experimental features enabled
-
DeliveryCraft malformed form payload
-
ExploitSend HTTP POST to remote function form endpoint
-
ExecutionTrigger unbounded deserialization CPU loop
-
ImpactServer becomes unresponsive (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target SvelteKit application has explicitly enabled BOTH experimental.remoteFunctions (an opt-in flag in the SvelteKit config) AND the form feature within that experimental context - neither is enabled by default. The vulnerable endpoint must be network-reachable; no authentication is required once the endpoint is accessible, per the CVSS PR:N metric. Exploitation is limited to @sveltejs/kit versions 2.49.0 through 2.52.1, as the experimental.remoteFunctions feature was introduced at 2.49.0. The constraint that both features must be co-enabled significantly limits the exposed population to applications that have consciously adopted experimental SvelteKit functionality. There is no platform or OS restriction - any Node.js environment running the affected version with these features active is vulnerable. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.7, indicating unauthenticated network-exploitable denial of service with no attack complexity - calibrated as if the vulnerable endpoint is reachable. The critical limiting factor not captured by the raw score is the prerequisite of both experimental.remoteFunctions and form being enabled; this is an opt-in experimental configuration, substantially reducing the real-world exposed population relative to the SvelteKit install base. EPSS data is not provided in available sources, but given the experimental-feature gating, opportunistic mass scanning is an unlikely exploitation path - targeted attacks against known deployments that use these features are the more plausible scenario. No KEV listing and no public exploit code exist at time of analysis, which lowers operational urgency compared to the 8.7 score alone. For teams not using experimental.remoteFunctions, this is a non-issue. For teams that are, the risk is high: a single malformed request can exhaust server CPU with no authentication required. |
| Exploit ScenarioDerived | An attacker identifies a publicly accessible SvelteKit application that has opted into experimental.remoteFunctions and form - discoverable via application behavior or JavaScript bundle analysis. The attacker crafts a malformed form payload designed to maximize deserialization work and sends it to the remote function form endpoint via a standard HTTP POST. The server's Node.js event loop becomes CPU-saturated processing the request, making the application unresponsive to legitimate traffic until the process is restarted or the request times out. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers to render affected servers unresponsive by submitting malformed form data, resulting in denial of service. Versions 2.49.0 through 2.52.1 of @sveltejs/kit are affected, but only when both the experimental.remoteFunctions and form features are simultaneously enabled - a non-default, opt-in configuration. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects the complete availability impact against network-reachable endpoints with no authentication barrier once the experimental features are active.
RemediationAI
The primary fix is upgrading @sveltejs/kit to version 2.52.2 or later, which resolves the unbounded CPU consumption in the form deserialization path (upstream patch commit: https://github.com/sveltejs/kit/commit/3e607b314aec9e5f278d32847945b8b6323e1cb8). Refer to the GHSA advisory at https://github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6 for confirmation. If upgrading immediately is not feasible, the most effective compensating control is disabling either experimental.remoteFunctions or the form feature in the SvelteKit configuration - removing either dependency breaks the vulnerable code path entirely, though it also disables associated application functionality. Additionally, placing a rate-limiting proxy or WAF rule upstream of the affected form endpoints to restrict request rate per IP can reduce the blast radius of an attack but does not eliminate the vulnerability, as a single prolonged malformed request may still exhaust CPU before rate limits trigger.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SvelteKit is a Node.js-based full-stack web framework (npm package @sveltejs/kit, CPE: cpe:2.3:a:sveltejs:kit:*:*:*:*:*:*:*:*). The vulnerability exists within the deserialization logic for form submissions processed by the experimental remote functions feature, introduced in version 2.49.0. CWE-400 (Uncontrolled Resource Consumption) is the root cause class: the parser fails to bound computational work when processing malformed or adversarially crafted form payloads, allowing an attacker to force the server into a CPU-intensive processing loop. This pattern - unbounded work triggered by attacker-controlled input - is a classic algorithmic complexity (ReDoS-adjacent) or recursive/iterative deserialization abuse. The experimental.remoteFunctions feature, by design, exposes server-side processing of form data to network requests, and the form handler does not impose resource limits or validate structural bounds on the input before beginning deserialization.
Know when Kit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network vector confirmed; PR:N because no authentication gates the form endpoint; A:H for complete availability loss; no confidentiality or integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.
Blast Radius
ecosystem impact- 1 npm packages depend on @sveltejs/kit (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.49.0.
Executive ViewAI
SvelteKit versions 2.49.0-2.52.1 contain a denial-of-service vulnerability in the experimental remote form deserialization feature that allows unauthenticated attackers to render affected applications unresponsive. Organizations with SvelteKit deployments that have opted into both experimental.remoteFunctions and form features face service outage risk with no authentication barrier. Immediate configuration assessment and mitigation are required.
Immediately disable the experimental.remoteFunctions feature to eliminate the attack vector. If the feature cannot be disabled, implement aggressive rate limiting on form endpoints to throttle malformed requests, deploy Web Application Firewall rules targeting malformed form payloads, restrict network access to affected applications to authorized users and IP ranges only, and monitor upstream resources for vendor-released patches. Monitor vendor advisories for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
SvelteKit is a web development kit. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authe
Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a
SvelteKit 2.19.0-2.49.4 has SSRF/DoS affecting applications with prerendered routes. Can be exploited to make the server
A path traversal vulnerability in SvelteKit's Vite preview server on Windows (versions 2.10.0 before 3.0.0) allows remot
Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who subm
Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the s
Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads,
SvelteKit versions 2.49.0 through 2.49.4 are vulnerable to denial-of-service attacks through the experimental form remot
Server-side request forgery in SvelteKit before 3.0.0 allows unauthenticated remote attackers to abuse the framework's s
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers
SvelteKit versions prior to 2.57.1 are vulnerable to denial of service when the redirect() function is called from the h
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition i
Exploit-DB