CVE-2026-82259

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82259
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82259.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82259
Aliases
Published
2026-08-28T10:49:42.969Z
Modified
2026-08-30T03:48:23.100171205Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
SvelteKit 2.49.0 before 2.53.3 Denial of Service via form
Details

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82259.json",
    "cwe_ids": [
        "CWE-502"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/sveltejs/kit

Affected ranges

Type
GIT
Repo
https://github.com/sveltejs/kit
Events
Introduced
ab3784911accefd8d3bc292a80d8e3b825528fd3
Fixed
66d88c93da40c48cf3f4aca871d74a4fc7ff3990
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "2.49.0"
        },
        {
            "fixed": "2.53.3"
        },
        {
            "fixed": "2.53.2"
        }
    ]
}

Affected versions

@sveltejs/adapter-auto@7.*
@sveltejs/adapter-auto@7.0.1
@sveltejs/adapter-cloudflare@7.*
@sveltejs/adapter-cloudflare@7.2.5
@sveltejs/adapter-cloudflare@7.2.6
@sveltejs/adapter-cloudflare@7.2.7
@sveltejs/adapter-cloudflare@7.2.8
@sveltejs/adapter-netlify@6.*
@sveltejs/adapter-netlify@6.0.0
@sveltejs/adapter-netlify@6.0.2
@sveltejs/adapter-netlify@6.0.3
@sveltejs/adapter-netlify@6.0.4
@sveltejs/adapter-node@5.*
@sveltejs/adapter-node@5.5.0
@sveltejs/adapter-node@5.5.1
@sveltejs/adapter-node@5.5.2
@sveltejs/adapter-node@5.5.3
@sveltejs/adapter-node@5.5.4
@sveltejs/adapter-vercel@6.*
@sveltejs/adapter-vercel@6.2.0
@sveltejs/adapter-vercel@6.3.0
@sveltejs/adapter-vercel@6.3.1
@sveltejs/adapter-vercel@6.3.2
@sveltejs/adapter-vercel@6.3.3
@sveltejs/enhanced-img@0.*
@sveltejs/enhanced-img@0.10.0
@sveltejs/enhanced-img@0.10.1
@sveltejs/enhanced-img@0.10.2
@sveltejs/enhanced-img@0.10.3
@sveltejs/enhanced-img@0.9.1
@sveltejs/enhanced-img@0.9.2
@sveltejs/enhanced-img@0.9.3
@sveltejs/kit@2.*
@sveltejs/kit@2.49.0
@sveltejs/kit@2.49.1
@sveltejs/kit@2.49.2
@sveltejs/kit@2.49.3
@sveltejs/kit@2.49.4
@sveltejs/kit@2.49.5
@sveltejs/kit@2.50.0
@sveltejs/kit@2.50.1
@sveltejs/kit@2.50.2
@sveltejs/kit@2.51.0
@sveltejs/kit@2.52.0
@sveltejs/kit@2.52.2
@sveltejs/kit@2.53.0
@sveltejs/kit@2.53.1
@sveltejs/kit@2.53.2
@sveltejs/package@2.*
@sveltejs/package@2.5.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82259.json"