Medium severity · published Aug 28, 2026
CVE-2026-82256
SvelteKit before 2.69.1 Denial of Service via Remote Form
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
kit · sveltejs
before 2.69.1 · source: vendor
SV
Sveltekit · Svelte
before 2.69.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82256
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82256
vendor-advisory
https://github.com/sveltejs/kit/security/advisories/GHSA-wqjv-9729-c5q2
third-party-advisory
https://www.vulncheck.com/advisories/sveltekit-before-2.69.1-denial-of-service-via-remote-form
More from kit
9.1
CVE-2025-67647
SvelteKit Denial of service and possible SSRF when using prerendering
7.5
CVE-2026-114063
SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
7.5
CVE-2026-82261
SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
7.5
CVE-2026-82260
SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
7.5
CVE-2026-82259
SvelteKit 2.49.0 before 2.53.3 Denial of Service via form