{"action":"Upgrade @sveltejs/kit to 2.52.2 or later.","affected":[{"fixed":"2.52.2","introduced":"2.49.0"}],"component":"@sveltejs/kit","cve_ids":["CVE-2026-82261"],"ecosystem":"npm","epss":0.00493,"exploited":false,"fixed_versions":["2.52.2"],"ghsa_id":"GHSA-88qp-p4qg-rqm6","id":"tcs_01M5KFCBHMEKF59K5ZB59HQ8TY","modified_at":"2026-09-02T03:55:41.454707662Z","published_at":"2026-02-19T20:30:25Z","references":["https://osv.dev/vulnerability/GHSA-88qp-p4qg-rqm6","https://github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6","https://github.com/sveltejs/kit/commit/3e607b314aec9e5f278d32847945b8b6323e1cb8","https://github.com/sveltejs/kit","https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-88qp-p4qg-rqm6","url":"https://osv.dev/vulnerability/GHSA-88qp-p4qg-rqm6"}],"summary":"CPU exhaustion in SvelteKit remote form deserialization (experimental only)"}