Packages / @sveltejs/kit / Security

ModerateVulnerabilityGHSA-vrhm-gvg7-fpcfCVE-2026-82260Published 19 Feb 2026

Memory exhaustion in SvelteKit remote form deserialization (experimental only)

Affected releases · @sveltejs/kit

  • 2.x2.49.0 – 2.52.0Fixed in 2.52.2

On 2.x, the newest line:

npm install @sveltejs/kit@2.52.2
3.x

  1. Not affected

    3.0.0 – 3.1.0

    3 releases, latest

2.x

  1. Not affected

    2.0.0 – 2.48.8

    189 releases

  2. Affected

    2.49.0 – 2.52.0

    11 releases

  3. Fixed

    2.52.2 – 2.70.3

    37 releases

389 stable releases of @sveltejs/kit, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @sveltejs/kit. It is read in your browser and sent nowhere.

What happens

Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.

Only applications using both experimental.remoteFunctions and form are vulnerable.