EUVD-2026-67586
GHSA-33c7-c62f-7cc2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker requires only network access and a malformed POST; non-default server config is a deployment prerequisite, not attacker complexity; impact is availability-only (server crash).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.
AnalysisAI
Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the server process by sending malformed form data to a remote function endpoint, resulting in complete denial of service. Exploitation is gated behind two simultaneous non-default opt-in conditions - the experimental.remoteFunctions flag and form usage - which significantly narrows the real-world attack surface relative to the CVSS 4.0 score of 8.7. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target application to be running @sveltejs/kit versions 2.49.0 through 2.52.1 AND to have experimental.remoteFunctions explicitly enabled in svelte.config.js AND to use the form integration in at least one route - all three conditions must hold simultaneously. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) accurately reflects the trivial attacker effort required once a vulnerable endpoint is reachable - no authentication, no complexity, no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade @sveltejs/kit to version 2.52.2 or later; this is the vendor-released patch confirmed by advisory GHSA-vrhm-gvg7-fpcf and fix commit f47c01bd8100328c24fdb8522fe35913b0735f35 (https://github.com/sveltejs/kit/commit/f47c01bd8100328c24fdb8522fe35913b0735f35). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Svelte.js deployments to identify which versions of @sveltejs/kit are in use and whether experimental.remoteFunctions is enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SvelteKit is a web development kit. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authe
SvelteKit 2.19.0-2.49.4 has SSRF/DoS affecting applications with prerendered routes. Can be exploited to make the server
CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers
Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who subm
Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads,
SvelteKit versions 2.49.0 through 2.49.4 are vulnerable to denial-of-service attacks through the experimental form remot
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers
SvelteKit versions prior to 2.57.1 are vulnerable to denial of service when the redirect() function is called from the h
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition i
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from Java
Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today