npm/@sveltejs/kit CVE-2026-82260: medium, EPSS 0.49%

Memory exhaustion in SvelteKit remote form deserialization (experimental only)

Action: Upgrade @sveltejs/kit to 2.52.2 or later.

npm i @sveltejs/kit@2.52.2

Affected

Fixed versions

Sources

• osv: GHSA-vrhm-gvg7-fpcf
• https://github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcf
• https://github.com/sveltejs/kit/commit/f47c01bd8100328c24fdb8522fe35913b0735f35
• https://github.com/sveltejs/kit
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2

CVE-2026-82260 · published 2026-02-19T20:29:42Z · modified 2026-09-02T03:55:42.139843995Z · JSON