PT-2026-22534 · Npm · @Sveltejs/Kit

Published 2026-02-19 · Updated 2026-02-19

OSV

CVSS v4.0

4.6

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.

Only applications using both experimental.remoteFunctions and form are vulnerable.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

GHSA-VRHM-GVG7-FPCF

Affected Products

@Sveltejs/Kit

References · 5

• https://osv.dev/vulnerability/GHSA-vrhm-gvg7-fpcf · Vendor Advisory
• https://github.com/sveltejs/kit · Note
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2 · Note
• https://github.com/sveltejs/kit/commit/f47c01bd8100328c24fdb8522fe35913b0735f35 · Note
• https://github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcf · Note