{"id":"EUVD-2026-67586","enisaUuid":"c42412de-07fe-3a41-8c25-8b8981f66b80","description":"SvelteKit (@sveltejs/kit) versions \u003e\u003d2.49.0 and \u003c\u003d2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.","datePublished":"Aug 28, 2026, 10:49:43 AM","dateUpdated":"Oct 8, 2026, 3:25:31 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcf\nhttps://www.vulncheck.com/advisories/sveltekit-before-2.52.2-memory-exhaustion-via-remote-form-deserialization\n","aliases":"CVE-2026-82260\nGHSA-33c7-c62f-7cc2\n","assigner":"VulnCheck","epss":0.49,"enisaIdProduct":[{"id":"91c1802a-4af4-3d07-a9ca-6767eab61e25","product":{"name":"kit","vendor":{"name":"sveltejs"}},"product_version":"2.49.0 \u003c2.52.1"}],"enisaIdVendor":[{"id":"082f6932-9040-3f7f-b024-4176a1eb7ff4","vendor":{"name":"sveltejs"}}],"enisaIdVulnerability":[{"id":"1a29f5ee-97e9-31fe-ace6-3c0f7ed8fa58","vulnerability":{"id":"CVE-2026-82260","description":"SvelteKit (@sveltejs/kit) versions \u003e\u003d2.49.0 and \u003c\u003d2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.","datePublished":"Aug 28, 2026, 10:49:43 AM","dateUpdated":"Oct 8, 2026, 3:25:31 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcf\nhttps://www.vulncheck.com/advisories/sveltekit-before-2.52.2-memory-exhaustion-via-remote-form-deserialization\n","enisa_id":"EUVD-2026-67586\n","assigner":"VulnCheck","epss":0.49,"dataProcessed":"Nov 3, 2026, 7:20:22 AM","vulnerabilityProduct":[{"id":"6c6c7fb4-717d-3f12-816e-5e11693aad39","product":{"name":"kit","vendor":{"name":"sveltejs"}},"product_version":"2.49.0 \u003c2.52.1"}],"vulnerabilityVendor":[{"id":"505a9de4-8621-3dc7-a265-ff516dca95bb","vendor":{"name":"sveltejs"}}]}},{"id":"814f4d8c-2aaf-375f-8cd2-cf07318a22a4","vulnerability":{"id":"GHSA-33c7-c62f-7cc2","description":"SvelteKit (@sveltejs/kit) versions \u003e\u003d2.49.0 and \u003c\u003d2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.","datePublished":"Aug 28, 2026, 12:30:29 PM","dateUpdated":"Aug 28, 2026, 12:30:30 PM","baseScore":0.0,"references":"https://github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-82260\nhttps://www.vulncheck.com/advisories/sveltekit-before-2.52.2-memory-exhaustion-via-remote-form-deserialization\n","enisa_id":"EUVD-2026-67586\n","aliases":"CVE-2026-82260\nGHSA-33c7-c62f-7cc2\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}