SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-82259 · Microsoft / collected KEV context

EUVD-2026-67585

GHSA-7jhg-723h-fjhx

GHSA-fpg4-jhqr-589c

cve-program · CVE-2026-82259

• https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c
• https://www.vulncheck.com/advisories/sveltekit-2.49.0-before-2.53.3-denial-of-service-via-form

euvd · EUVD-2026-67585

• https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c
• https://www.vulncheck.com/advisories/sveltekit-2.49.0-before-2.53.3-denial-of-service-via-form

nvd · CVE-2026-82259

• https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c
• https://www.vulncheck.com/advisories/sveltekit-2.49.0-before-2.53.3-denial-of-service-via-form

osv · GHSA-fpg4-jhqr-589c

• https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c
• https://github.com/sveltejs/kit/commit/faba869db3644077169bf5d7c6e41fd5f3d6c65e
• https://github.com/sveltejs/kit
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]

No related operational record is retained in the current change model.