8.7
Élevée
CVE-2026-82261 SvelteKit (@sveltejs/kit) versions >=2.49.0…
Description
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.
Produits et versions touchés
Autres CVE de kit
Les 22 CVE de kit →
CVE-2026-114063
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on…
8.7
Élevée
CVE-2026-114062
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach…
6.9
Moyenne
CVE-2026-114061
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a…
2.3
Faible
CVE-2026-114060
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on…
2.1
Faible