PT-2026-22529 · Npm · @Sveltejs/Kit

Publicado 2026-02-19 · Atualizado 2026-02-19

OSV

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service.

Only applications using both experimental.remoteFunctions and form are vulnerable.

Correção

Type Confusion

Enumeração de Fraquezas

CWE-843

Identificadores relacionados

GHSA-88QP-P4QG-RQM6

Produtos afetados

@Sveltejs/Kit

Referências · 5

• https://github.com/sveltejs/kit · Nota
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2 · Nota
• https://github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6 · Nota
• https://github.com/sveltejs/kit/commit/3e607b314aec9e5f278d32847945b8b6323e1cb8 · Nota
• https://osv.dev/vulnerability/GHSA-88qp-p4qg-rqm6 · Aviso do Fabricante