CVE-2025-62381 HIGH

CVE-2025-62381: sveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`

Vendor Ciscoheat
Product sveltekit-superforms
Weakness CWE-1321
Published October 15, 2025
Last update October 15, 2025
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L

What the vulnerability does

01Description

sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4.

Key dates

02Disclosure timeline

October 15, 2025 CVE published
October 15, 2025 Record updated