EUVD-2026-67586
GHSA-33c7-c62f-7cc2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify SvelteKit app with remote functions exposed
-
DeliveryLocate form-enabled route or endpoint
-
ExploitSend crafted POST with malformed form payload
-
InstallTrigger unbounded memory allocation in deserializer
-
C2Exhaust server process memory
-
ExecuteCrash Node.js process
-
ImpactApplication unavailable to all users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to be running @sveltejs/kit versions 2.49.0 through 2.52.1 AND to have experimental.remoteFunctions explicitly enabled in svelte.config.js AND to use the form integration in at least one route - all three conditions must hold simultaneously. These are non-default, opt-in experimental settings; applications without experimental.remoteFunctions are completely unaffected regardless of kit version. Once this configuration is present, the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, user interaction, or special network position is required - any client that can reach a form-enabled remote function endpoint can trigger the vulnerability. |
| Impact | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) accurately reflects the trivial attacker effort required once a vulnerable endpoint is reachable - no authentication, no complexity, no user interaction. However, the score does not encode the critical deployment prerequisite: both experimental.remoteFunctions and form must be explicitly enabled, neither of which is on by default. Applications not using this experimental feature are entirely unaffected. No EPSS score was provided in the available data, and with no KEV listing and no public proof-of-concept, widespread opportunistic scanning is not currently confirmed. The availability impact is real and complete - a successful attack crashes the server process - making this a genuine priority for any application running the affected configuration, but a non-issue for the majority of SvelteKit deployments that have not opted into the experimental feature. Remediation is low-friction: upgrading to 2.52.2 is the definitive fix, and the patch is already available. |
| Exploit ScenarioDerived | An attacker identifies a SvelteKit application (versions 2.49.0-2.52.1) with experimental.remoteFunctions and form enabled by fingerprinting the framework or scanning for known route patterns, then sends a crafted HTTP POST request containing malformed form data to a remote function endpoint. The server's deserialization routine allocates memory without bound while processing the payload, exhausting available RAM and crashing the Node.js process, taking the entire application offline for all users. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the server process by sending malformed form data to a remote function endpoint, resulting in complete denial of service. Exploitation is gated behind two simultaneous non-default opt-in conditions - the experimental.remoteFunctions flag and form usage - which significantly narrows the real-world attack surface relative to the CVSS 4.0 score of 8.7. No public exploit or CISA KEV listing has been identified; a vendor-released patch is available in version 2.52.2.
RemediationAI
Upgrade @sveltejs/kit to version 2.52.2 or later; this is the vendor-released patch confirmed by advisory GHSA-vrhm-gvg7-fpcf and fix commit f47c01bd8100328c24fdb8522fe35913b0735f35 (https://github.com/sveltejs/kit/commit/f47c01bd8100328c24fdb8522fe35913b0735f35). If an immediate upgrade is not feasible, the most effective compensating control is disabling experimental.remoteFunctions in the SvelteKit configuration, which removes the vulnerable deserialization path entirely - this trade-off is that the remote functions feature becomes unavailable. A secondary mitigation is configuring a reverse proxy (e.g., nginx with client_max_body_size) to enforce strict inbound request body size limits, which can reduce - but not fully eliminate - the risk of exhaustion via malformed payloads. Neither workaround is a substitute for patching to 2.52.2.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SvelteKit (@sveltejs/kit) is a Svelte-based server-side rendering meta-framework for Node.js web applications distributed via npm. The vulnerability was introduced alongside the experimental remote functions feature (experimental.remoteFunctions), added in version 2.49.0. When a route uses both remote functions and the form integration, inbound form payloads are deserialized server-side. The deserialization routine fails to enforce memory allocation bounds when processing malformed payloads, mapping to CWE-400 (Uncontrolled Resource Consumption): the server allocates unbounded memory until the Node.js process exhausts available RAM and crashes. The affected package is identified by CPE cpe:2.3:a:sveltejs:kit:*:*:*:*:*:*:*:* for the version range 2.49.0 through 2.52.1. The fix is confirmed in commit f47c01bd8100328c24fdb8522fe35913b0735f35.
Know when Kit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Attacker requires only network access and a malformed POST; non-default server config is a deployment prerequisite, not attacker complexity; impact is availability-only (server crash).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.
Blast Radius
ecosystem impact- 1 npm packages depend on @sveltejs/kit (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.49.0.
Executive ViewAI
Svelte.js applications using experimental remote function features (versions 2.49.0-2.52.1) are vulnerable to remote denial-of-service attacks that crash servers with malformed requests, causing complete service outage. Affected organizations face immediate downtime risk and require upgrading to version 2.52.2.
Vendor-released patch: 2.52.2
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
SvelteKit is a web development kit. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authe
Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a
SvelteKit 2.19.0-2.49.4 has SSRF/DoS affecting applications with prerendered routes. Can be exploited to make the server
Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who subm
CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers
Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads,
SvelteKit versions 2.49.0 through 2.49.4 are vulnerable to denial-of-service attacks through the experimental form remot
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers
SvelteKit versions prior to 2.57.1 are vulnerable to denial of service when the redirect() function is called from the h
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition i
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from Java
Unauthenticated remote attackers can tamper with limited plugin-controlled data in Kit (formerly ConvertKit) for WooComm
Exploit-DB