PT-2026-24195 · Npm · @Sveltejs/Kit

Publicado 2026-02-28 · Atualizado 2026-02-28

OSV

CVSS v4.0

1.7

Baixa

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

Some relatively small inputs can cause very large files arrays in form handlers. If the SvelteKit application code doesn't check files.length or individual files' sizes and performs expensive processing with them, it can result in Denial of Service.

Only users with experimental.remoteFunctions: true who are using the form function and are processing the files array without validation are vulnerable.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

GHSA-FPG4-JHQR-589C

Produtos afetados

@Sveltejs/Kit

Referências · 5

• https://github.com/sveltejs/kit · Nota
• https://github.com/sveltejs/kit/commit/faba869db3644077169bf5d7c6e41fd5f3d6c65e · Nota
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.53.3 · Nota
• https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c · Nota
• https://osv.dev/vulnerability/GHSA-fpg4-jhqr-589c · Aviso do Fabricante