CVE-2026-82261 HIGH

CVE-2026-82261: SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization

Vendor Sveltejs
Product kit
Weakness CWE-400
Published August 28, 2026
Last update August 28, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.

Key dates

02Disclosure timeline

August 28, 2026 CVE published
August 28, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-24893 Stars Rating < 3.5.1 - Comments Denial of Service CVE-2023-49837 WordPress embed-code plugin <= 2.3.6 - Denial of Service Attack vulnerability CVE-2026-7493 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service CVE-2023-35909 WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack CVE-2024-0842 Backuply - Backup, Restore, Migrate and Clone <= 1.2.6 - Denial of Service