CVE-2026-82256

EUVD-2026-67582
SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.79%
Common Weakness Enumeration
References
https://github.com/sveltejs/kit/security/advisories/GHSA-wqjv-9729-c5q2
https://www.vulncheck.com/advisories/sveltekit-before-2.69.1-denial-of-service-via-remote-form