Packages / @sveltejs/kit / Security

ModerateVulnerabilityGHSA-88qp-p4qg-rqm6CVE-2026-82261Published 19 Feb 2026

CPU exhaustion in SvelteKit remote form deserialization (experimental only)

Affected releases · @sveltejs/kit

  • 2.x2.49.0 – 2.52.0Fixed in 2.52.2

On 2.x, the newest line:

npm install @sveltejs/kit@2.52.2
3.x

  1. Not affected

    3.0.0 – 3.1.0

    3 releases, latest

2.x

  1. Not affected

    2.0.0 – 2.48.8

    189 releases

  2. Affected

    2.49.0 – 2.52.0

    11 releases

  3. Fixed

    2.52.2 – 2.70.3

    37 releases

389 stable releases of @sveltejs/kit, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @sveltejs/kit. It is read in your browser and sent nowhere.

What happens

Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service.

Only applications using both experimental.remoteFunctions and form are vulnerable.