CVE-2026-82261

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82261
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82261.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82261
Aliases
Published
2026-08-28T10:49:44Z
Modified
2026-09-02T03:47:22Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
Details

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82261.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.49.0"
                },
                {
                    "fixed": "2.52.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "2.49.0"
                },
                {
                    "fixed": "2.52.1"
                }
            ],
            "source": "CPE_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/sveltejs/kit

Affected ranges

Type
GIT
Repo
https://github.com/sveltejs/kit
Events
Introduced
ab3784911accefd8d3bc292a80d8e3b825528fd3
Fixed
9c4a73733441acaa2f166d023fcdb977a9d88cf6
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:svelte:sveltekit:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "2.49.0"
        },
        {
            "fixed": "2.52.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

@sveltejs/adapter-auto@7.*
@sveltejs/adapter-auto@7.0.1
@sveltejs/adapter-cloudflare@7.*
@sveltejs/adapter-cloudflare@7.2.5
@sveltejs/adapter-cloudflare@7.2.6
@sveltejs/adapter-cloudflare@7.2.7
@sveltejs/adapter-netlify@6.*
@sveltejs/adapter-netlify@6.0.0
@sveltejs/adapter-node@5.*
@sveltejs/adapter-node@5.5.0
@sveltejs/adapter-node@5.5.1
@sveltejs/adapter-node@5.5.2
@sveltejs/adapter-node@5.5.3
@sveltejs/adapter-vercel@6.*
@sveltejs/adapter-vercel@6.2.0
@sveltejs/adapter-vercel@6.3.0
@sveltejs/adapter-vercel@6.3.1
@sveltejs/enhanced-img@0.*
@sveltejs/enhanced-img@0.10.0
@sveltejs/enhanced-img@0.10.1
@sveltejs/enhanced-img@0.10.2
@sveltejs/enhanced-img@0.9.1
@sveltejs/enhanced-img@0.9.2
@sveltejs/enhanced-img@0.9.3
@sveltejs/kit@2.*
@sveltejs/kit@2.49.0
@sveltejs/kit@2.49.1
@sveltejs/kit@2.49.2
@sveltejs/kit@2.49.3
@sveltejs/kit@2.49.4
@sveltejs/kit@2.49.5
@sveltejs/kit@2.50.0
@sveltejs/kit@2.50.1
@sveltejs/kit@2.50.2
@sveltejs/kit@2.51.0
@sveltejs/kit@2.52.0
@sveltejs/package@2.*
@sveltejs/package@2.5.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82261.json"