PT-2026-22534 · Npm · @Sveltejs/Kit

Publicado 2026-02-19 · Atualizado 2026-02-19

OSV

CVSS v4.0

4.6

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.

Only applications using both experimental.remoteFunctions and form are vulnerable.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

GHSA-VRHM-GVG7-FPCF

Produtos afetados

@Sveltejs/Kit

Referências · 5

• https://github.com/sveltejs/kit · Nota
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2 · Nota
• https://github.com/sveltejs/kit/commit/f47c01bd8100328c24fdb8522fe35913b0735f35 · Nota
• https://github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcf · Nota
• https://osv.dev/vulnerability/GHSA-vrhm-gvg7-fpcf · Aviso do Fabricante