CVE-2026-128120

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-128120
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128120.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-128120
Aliases
  • GHSA-3r8g-jcqq-3p5j
Published
2026-11-13T19:34:08Z
Modified
2026-11-15T02:46:33Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
SvelteKit: DoS while parsing form data from a remote functions `form`
Details

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.42.0 until 3.1.1, applications using the experimental remote functions flag and a remote form function could perform quadratic synchronous work while parsing a specially crafted request with many form entries. The parsing work could block the event loop for an extended period and deny service. This issue is fixed in 3.1.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128120.json"
}
References

Affected packages

Git / github.com/sveltejs/kit

Affected ranges

Type
GIT
Repo
https://github.com/sveltejs/kit
Events
Introduced
3de8e38010b8ecb8243b4ff47541c6d9a94805f8
Fixed
4a75141ca7fab2ad70e472203c81adef0dea90a2
Fixed
24d8ee409d83c438330ff2850b4f159c1222aa27
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.42.0"
                },
                {
                    "fixed": "3.1.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "24d8ee409d83c438330ff2850b4f159c1222aa27"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

@sveltejs/adapter-auto@6.*
@sveltejs/adapter-auto@6.1.1
@sveltejs/adapter-auto@7.*
@sveltejs/adapter-auto@7.0.0
@sveltejs/adapter-auto@7.0.1
@sveltejs/adapter-auto@8.*
@sveltejs/adapter-auto@8.0.0
@sveltejs/adapter-bun@1.*
@sveltejs/adapter-bun@1.0.0
@sveltejs/adapter-cloudflare@7.*
@sveltejs/adapter-cloudflare@7.2.4
@sveltejs/adapter-cloudflare@7.2.5
@sveltejs/adapter-cloudflare@7.2.6
@sveltejs/adapter-cloudflare@7.2.7
@sveltejs/adapter-cloudflare@7.2.8
@sveltejs/adapter-cloudflare@7.2.9
@sveltejs/adapter-cloudflare@8.*
@sveltejs/adapter-cloudflare@8.0.0
@sveltejs/adapter-cloudflare@8.0.1
@sveltejs/adapter-netlify@5.*
@sveltejs/adapter-netlify@5.2.4
@sveltejs/adapter-netlify@6.*
@sveltejs/adapter-netlify@6.0.0
@sveltejs/adapter-netlify@6.0.2
@sveltejs/adapter-netlify@6.0.3
@sveltejs/adapter-netlify@6.0.4
@sveltejs/adapter-netlify@7.*
@sveltejs/adapter-netlify@7.0.0
@sveltejs/adapter-netlify@7.0.1
@sveltejs/adapter-node@5.*
@sveltejs/adapter-node@5.3.3
@sveltejs/adapter-node@5.4.0
@sveltejs/adapter-node@5.5.0
@sveltejs/adapter-node@5.5.1
@sveltejs/adapter-node@5.5.2
@sveltejs/adapter-node@5.5.3
@sveltejs/adapter-node@5.5.4
@sveltejs/adapter-node@5.5.5
@sveltejs/adapter-node@5.5.6
@sveltejs/adapter-node@5.5.7
@sveltejs/adapter-node@6.*
@sveltejs/adapter-node@6.0.0
@sveltejs/adapter-static@3.*
@sveltejs/adapter-static@3.0.10
@sveltejs/adapter-static@4.*
@sveltejs/adapter-static@4.0.0
@sveltejs/adapter-vercel@5.*
@sveltejs/adapter-vercel@5.10.3
@sveltejs/adapter-vercel@6.*
@sveltejs/adapter-vercel@6.0.0
@sveltejs/adapter-vercel@6.1.0
@sveltejs/adapter-vercel@6.1.1
@sveltejs/adapter-vercel@6.1.2
@sveltejs/adapter-vercel@6.2.0
@sveltejs/adapter-vercel@6.3.0
@sveltejs/adapter-vercel@6.3.1
@sveltejs/adapter-vercel@6.3.2
@sveltejs/adapter-vercel@6.3.3
@sveltejs/adapter-vercel@6.3.4
@sveltejs/adapter-vercel@7.*
@sveltejs/adapter-vercel@7.0.0
@sveltejs/adapter-vercel@7.0.1
@sveltejs/enhanced-img@0.*
@sveltejs/enhanced-img@0.10.0
@sveltejs/enhanced-img@0.10.1
@sveltejs/enhanced-img@0.10.2
@sveltejs/enhanced-img@0.10.3
@sveltejs/enhanced-img@0.10.4
@sveltejs/enhanced-img@0.11.0
@sveltejs/enhanced-img@0.8.2
@sveltejs/enhanced-img@0.8.3
@sveltejs/enhanced-img@0.8.4
@sveltejs/enhanced-img@0.8.5
@sveltejs/enhanced-img@0.9.0
@sveltejs/enhanced-img@0.9.1
@sveltejs/enhanced-img@0.9.2
@sveltejs/enhanced-img@0.9.3
@sveltejs/enhanced-img@1.*
@sveltejs/enhanced-img@1.0.0
@sveltejs/kit@2.*
@sveltejs/kit@2.42.0
@sveltejs/kit@2.42.1
@sveltejs/kit@2.42.2
@sveltejs/kit@2.43.0
@sveltejs/kit@2.43.1
@sveltejs/kit@2.43.2
@sveltejs/kit@2.43.3
@sveltejs/kit@2.43.4
@sveltejs/kit@2.43.5
@sveltejs/kit@2.43.6
@sveltejs/kit@2.43.7
@sveltejs/kit@2.43.8
@sveltejs/kit@2.44.0
@sveltejs/kit@2.45.0
@sveltejs/kit@2.46.0
@sveltejs/kit@2.46.1
@sveltejs/kit@2.46.2
@sveltejs/kit@2.46.3
@sveltejs/kit@2.46.4
@sveltejs/kit@2.46.5
@sveltejs/kit@2.47.0
@sveltejs/kit@2.47.1
@sveltejs/kit@2.47.2
@sveltejs/kit@2.47.3
@sveltejs/kit@2.48.0
@sveltejs/kit@2.48.1
@sveltejs/kit@2.48.2
@sveltejs/kit@2.48.3
@sveltejs/kit@2.48.4
@sveltejs/kit@2.48.5
@sveltejs/kit@2.48.6
@sveltejs/kit@2.48.7
@sveltejs/kit@2.48.8
@sveltejs/kit@2.49.0
@sveltejs/kit@2.49.1
@sveltejs/kit@2.49.2
@sveltejs/kit@2.49.3
@sveltejs/kit@2.49.4
@sveltejs/kit@2.49.5
@sveltejs/kit@2.50.0
@sveltejs/kit@2.50.1
@sveltejs/kit@2.50.2
@sveltejs/kit@2.51.0
@sveltejs/kit@2.52.0
@sveltejs/kit@2.52.2
@sveltejs/kit@2.53.0
@sveltejs/kit@2.53.1
@sveltejs/kit@2.53.2
@sveltejs/kit@2.53.3
@sveltejs/kit@2.53.4
@sveltejs/kit@2.54.0
@sveltejs/kit@2.55.0
@sveltejs/kit@2.56.0
@sveltejs/kit@2.56.1
@sveltejs/kit@2.57.0
@sveltejs/kit@2.57.1
@sveltejs/kit@2.58.0
@sveltejs/kit@2.59.0
@sveltejs/kit@2.59.1
@sveltejs/kit@2.60.0
@sveltejs/kit@2.60.1
@sveltejs/kit@2.61.0
@sveltejs/kit@2.61.1
@sveltejs/kit@2.62.0
@sveltejs/kit@2.63.0
@sveltejs/kit@2.63.1
@sveltejs/kit@2.64.0
@sveltejs/kit@2.65.0
@sveltejs/kit@2.65.1
@sveltejs/kit@2.65.2
@sveltejs/kit@2.66.0
@sveltejs/kit@2.67.0
@sveltejs/kit@2.68.0
@sveltejs/kit@2.69.0
@sveltejs/kit@2.69.1
@sveltejs/kit@2.69.2
@sveltejs/kit@2.69.3
@sveltejs/kit@2.70.0
@sveltejs/kit@2.70.1
@sveltejs/kit@2.70.2
@sveltejs/kit@2.70.3
@sveltejs/kit@3.*
@sveltejs/kit@3.0.0
@sveltejs/kit@3.0.1
@sveltejs/kit@3.1.0
@sveltejs/package@2.*
@sveltejs/package@2.5.3
@sveltejs/package@2.5.4
@sveltejs/package@2.5.5
@sveltejs/package@2.5.6
@sveltejs/package@2.5.7
@sveltejs/package@2.5.8
@sveltejs/package@3.*
@sveltejs/package@3.0.0
@sveltejs/package@3.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128120.json"