{"id":"GHSA-88qp-p4qg-rqm6","revision":"7747c1bc2ca74fad9fc4419d1fa5a8a1","records":[{"revision":"7747c1bc2ca74fad9fc4419d1fa5a8a1","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-88qp-p4qg-rqm6","aliases":["CVE-2026-82261"],"title":"CPU exhaustion in SvelteKit remote form deserialization (experimental only)","description":"Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service.\n\nOnly applications using both `experimental.remoteFunctions` and `form` are vulnerable.","state":0,"publishedAt":"2026-02-19T20:30:25+00:00","modifiedAt":"2026-09-02T03:55:41.4547077+00:00","affected":[{"ecosystem":"npm","name":"@sveltejs/kit","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.49.0"},{"kind":"fixed","version":"2.52.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6","https://github.com/sveltejs/kit/commit/3e607b314aec9e5f278d32847945b8b6323e1cb8","https://github.com/sveltejs/kit","https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2"],"sourceUrl":"https://github.com/advisories/GHSA-88qp-p4qg-rqm6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-88qp-p4qg-rqm6","identifiers":["GHSA-88qp-p4qg-rqm6","CVE-2026-82261"]},"retained":false,"historicalAffected":[]}],"coverage":[]}