CVE-2026-82260

SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1, when configured with the experimental remote functions feature (experimental.remoteFunctions) and forms enabled, mishandle deserialization of remote form data, allowing malformed form submissions to trigger excessive memory allocation (CWE-400). An unauthenticated remote attacker can send crafted form data to the affected deserialization path to exhaust server memory. The impact is a crash of the server process resulting in denial of service, with high availability impact only (CVSS 4.0: 8.7, VA:H) and no indication of code execution or data compromise. Only applications running the affected version range with this experimental configuration are exposed, and the flaw is fixed in 2.52.2. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only a ~0.3% probability of exploitation within 30 days, so no real-world exploitation is currently documented.

What to do: Upgrade @sveltejs/kit to 2.52.2 or later. If an immediate upgrade is not possible, disable the experimental remote functions feature (or remote form usage) or add request body size limits and rate limiting on form endpoints. Check your lockfile for @sveltejs/kit versions in the 2.49.0-2.52.1 range and confirm whether experimental.remoteFunctions is enabled in your SvelteKit config.