GHSA-fpg4-jhqr-589c

Source

https://github.com/advisories/GHSA-fpg4-jhqr-589c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpg4-jhqr-589c/GHSA-fpg4-jhqr-589c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fpg4-jhqr-589c

Aliases

CVE-2026-82259

Published

2026-02-28T02:04:39Z

Modified

2026-08-29T03:55:36Z

Severity

1.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)

Details

Some relatively small inputs can cause very large files arrays in form handlers. If the SvelteKit application code doesn't check files.length or individual files' sizes and performs expensive processing with them, it can result in Denial of Service.

Only users with experimental.remoteFunctions: true who are using the form function and are processing the files array without validation are vulnerable.

Database specific

{
    "cwe_ids":  [
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-28T02:04:39Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

npm / @sveltejs/kit

Package

Name: @sveltejs/kit; View open source insights on deps.dev
Purl: pkg:npm/%40sveltejs/kit

Affected ranges

Type: SEMVER
Events: Introduced

2.49.0

Fixed

2.53.3

Database specific

last_known_affected_version_range

"<= 2.53.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpg4-jhqr-589c/GHSA-fpg4-jhqr-589c.json"