Packages / @sveltejs/kit / Security

ModerateVulnerabilityGHSA-wqjv-9729-c5q2CVE-2026-82256Published 24 Jul 2026

SvelteKit: Big remote form function payloads can cause Node process to crash

Affected releases · @sveltejs/kit

  • 2.x2.0.0 – 2.69.0Fixed in 2.69.1
  • 1.x and older0.0.8 – 1.30.4No fix, no longer updated

On 2.x, the newest line:

npm install @sveltejs/kit@2.69.1
3.x

  1. Not affected

    3.0.0 – 3.1.0

    3 releases, latest

2.x

  1. Affected

    2.0.0 – 2.69.0

    230 releases

  2. Fixed

    2.69.1 – 2.70.3

    7 releases

1.x

  1. Affected

    1.0.0 – 1.30.4

    128 releases

0.x

  1. Affected

    0.0.8 – 0.0.30

    21 releases

389 stable releases of @sveltejs/kit, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @sveltejs/kit. It is read in your browser and sent nowhere.

What happens

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.