CVE-2026-22803

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22803
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22803.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22803
Aliases
Published
2026-01-15T18:37:57.831Z
Modified
2026-03-01T02:56:18.261747Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer
Details

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22803.json",
    "cwe_ids": [
        "CWE-789"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/sveltejs/kit

Affected ranges

Type
GIT
Repo
https://github.com/sveltejs/kit
Events
Introduced
ab3784911accefd8d3bc292a80d8e3b825528fd3
Fixed
80ffb53382e397a8fc83e6b63d2675eeabb427bd

Affected versions

@sveltejs/adapter-node@5.*
@sveltejs/adapter-node@5.5.0
@sveltejs/adapter-vercel@6.*
@sveltejs/adapter-vercel@6.2.0
@sveltejs/adapter-vercel@6.3.0
@sveltejs/enhanced-img@0.*
@sveltejs/enhanced-img@0.9.1
@sveltejs/enhanced-img@0.9.2
@sveltejs/kit@2.*
@sveltejs/kit@2.49.0
@sveltejs/kit@2.49.1
@sveltejs/kit@2.49.2
@sveltejs/kit@2.49.3
@sveltejs/kit@2.49.4
@sveltejs/package@2.*
@sveltejs/package@2.5.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22803.json"