CVE-2026-22803

HIGH

Svelte Kit < 2.49.5 - Resource Allocation Without Limits

Title source: rule

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.

References (3)

[Vendor Advisory] https://github.com/sveltejs/kit/security/advisories/GHSA-j2f3-wq62-6q46

[Patch] https://github.com/sveltejs/kit/commit/8ed8155215b9a74012fecffb942ad9a793b274e5

View Patch ZIP pw:eip

[Release Notes] https://github.com/sveltejs/kit/releases/tag/@sveltejs%[email protected]

Scores

CVSS v3 7.5

EPSS 0.0002

EPSS Percentile 5.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-770 CWE-789

Status published

Products (2)

svelte/kit 2.49.0 - 2.49.5

sveltejs/kit 2.49.0 - 2.49.5npm

Published Jan 15, 2026

Tracked Since Feb 18, 2026