GitHub Advisoryadvisory · npm
GHSA-88qp-p4qg-rqm6 CPU exhaustion in SvelteKit remote form deserialization (experimental only)
MEDIUM
Official page ↗
- Ecosystem
- npm
- Packages
- @sveltejs/kit
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Weaknesses
- CWE-843
- Reviewed
- 2026-02-19
Affected packages
• npm @sveltejs/kit: >= 2.49.0, < 2.52.2 → fixed in 2.52.2
Description
Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service.
Only applications using both `experimental.remoteFunctions` and `form` are vulnerable.
Related
Weakness · CWE (1)
- CWE-843 Access of Resource Using Incompatible Type weakness