npm/@sveltejs/kit CVE-2026-82259: high 7.5, EPSS 0.53%
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)
Action: Upgrade @sveltejs/kit to 2.53.3 or later.
npm i @sveltejs/kit@2.53.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.49.0 | 2.53.3 | - |
Fixed versions
| 2.53.3 |
Sources
- osv: GHSA-fpg4-jhqr-589c
- nvd: CVE-2026-82259
- https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c
- https://github.com/sveltejs/kit/commit/faba869db3644077169bf5d7c6e41fd5f3d6c65e
- https://github.com/sveltejs/kit
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.53.3
CVE-2026-82259 · published · modified · JSON