CVE-2026-82260Patch(svelte / sveltekit)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch svelte sveltekit systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.

svelte CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

sveltekit

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Affected systems

Vendors

svelte

Products

sveltekit

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-82260/

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters46d
Patch
CVE-2026-82260 - DoS in SvelteKit. Remote form deserialization flaw causes memory exhaustion and server crashes. CVSS 7.5. Update to 2.52.2 immediately. #CVE #Svelte #infosec https://www.valtersit.com/cve/CVE-2026-82260/ #CVE #CVEAlert #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #china #france #germany #docker
Post summary
The post announces CVE-2026-82260, a DoS vulnerability in SvelteKit affecting remote form deserialization, and urges users to update to v2.52.2 immediately.
0000059
1.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	svelte	sveltekit	-	node.js	-

Explore more

Back to dashboard svelte CVEs sveltekit vulnerabilities