CVE-2026-82259

7.5 Élevée

Publiée le 28/08/2026 à 14:16 · Modifiée le 08/10/2026 à 18:17 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	8.7 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	7.5 Élevée	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-502

Références

https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c Vendor Advisory
https://www.vulncheck.com/advisories/sveltekit-2.49.0-before-2.53.3-denial-of-service-via-form Third Party Advisory

CVE-2026-82259

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs