CVE-2026-82256

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.

CVSS 4.0

6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-25)

CWE

CWE-400

Published

2026-08-28

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Affected

• svelte:sveltekit

Packages (OSV)

References

• https://github.com/sveltejs/kit/security/advisories/GHSA-wqjv-9729-c5q2
• https://www.vulncheck.com/advisories/sveltekit-before-2.69.1-denial-of-service-via-remote-form

Check your stackJSON