6.9
Medium
CVE-2026-82256 SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the…
Description
SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| kit 2.69 | earliest → < 2.69.1 | 2.69.1 |
References
Timeline
- Published
- Last modified
Other CVEs of kit
The 22 CVEs of kit →
CVE-2026-114063
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on…
8.7
High
CVE-2026-114062
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach…
6.9
Medium
CVE-2026-114061
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a…
2.3
Low
CVE-2026-114060
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on…
2.1
Low