PT-2026-22529 · Npm · @Sveltejs/Kit

Published 2026-02-19 · Updated 2026-02-19

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service.

Only applications using both experimental.remoteFunctions and form are vulnerable.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

GHSA-88QP-P4QG-RQM6

Affected Products

@Sveltejs/Kit

References · 5

• https://osv.dev/vulnerability/GHSA-88qp-p4qg-rqm6 · Vendor Advisory
• https://github.com/sveltejs/kit · Note
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2 · Note
• https://github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6 · Note
• https://github.com/sveltejs/kit/commit/3e607b314aec9e5f278d32847945b8b6323e1cb8 · Note