CVE-2026-22803

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22803
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22803.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22803
Aliases
Published
2026-01-15T18:37:57.831Z
Modified
2026-07-15T01:49:08.905634226Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer
Details

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22803.json",
    "cwe_ids": [
        "CWE-789"
    ]
}
References

Affected packages

Git / github.com/sveltejs/kit

Affected ranges

Type
GIT
Repo
https://github.com/sveltejs/kit
Events
Introduced
ab3784911accefd8d3bc292a80d8e3b825528fd3
Fixed
80ffb53382e397a8fc83e6b63d2675eeabb427bd
Fixed
8ed8155215b9a74012fecffb942ad9a793b274e5
Database specific 
{
    "cpe": "cpe:2.3:a:svelte:kit:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "2.49.0"
        },
        {
            "fixed": "2.49.5"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

@sveltejs/adapter-node@5.*
@sveltejs/adapter-node@5.5.0
@sveltejs/adapter-vercel@6.*
@sveltejs/adapter-vercel@6.2.0
@sveltejs/adapter-vercel@6.3.0
@sveltejs/enhanced-img@0.*
@sveltejs/enhanced-img@0.9.1
@sveltejs/enhanced-img@0.9.2
@sveltejs/kit@2.*
@sveltejs/kit@2.49.0
@sveltejs/kit@2.49.1
@sveltejs/kit@2.49.2
@sveltejs/kit@2.49.3
@sveltejs/kit@2.49.4
@sveltejs/package@2.*
@sveltejs/package@2.5.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22803.json"