CVE-2026-22803 HIGH

CVE-2026-22803: SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer

Vendor Sveltejs
Product kit
Weakness CWE-789
Published January 15, 2026
Last update January 15, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.

Key dates

02Disclosure timeline

January 15, 2026 CVE published
January 15, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2018-25274 InfraRecorder 0.53 Denial of Service via txt File Import CVE-2026-42440 Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader CVE-2025-8696 DoS attack against the Stork UI from an unauthenticated user CVE-2024-2494 Libvirt: negative g_new0 length can lead to unbounded memory allocation CVE-2026-50734 Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation