CVE-2026-82261

SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a CPU exhaustion flaw (CWE-400) in the deserialization of form data used with the experimental remote functions feature. An unauthenticated remote attacker can send crafted, malformed form data to an affected endpoint, causing the server to consume excessive CPU and become unresponsive while processing the request, resulting in denial of service. The attack requires no privileges or user interaction, and the CVSS 4.0 rating of 8.7 (high) reflects a high availability impact with no confidentiality or integrity impact. Only SvelteKit applications running 2.49.0–2.52.1 that have both experimental remote functions and form handling enabled are affected, and the flaw is fixed in 2.52.2. There are no known public proofs of concept, the vulnerability is not in CISA KEV, and EPSS estimates only about a 0.3% chance of exploitation in the next 30 days.

What to do: Upgrade @sveltejs/kit to 2.52.2 or later. If an immediate upgrade is not possible, disable the experimental remote functions/form feature or limit exposure of affected endpoints, for example via rate limiting or WAF rules against malformed form submissions. Check package.json and lockfiles for @sveltejs/kit in the 2.49.0–2.52.1 range and confirm whether the experimental remote functions and form feature is enabled in your configuration.