{"action":"Upgrade @sveltejs/kit to 2.52.2 or later.","affected":[{"fixed":"2.52.2","introduced":"2.49.0"}],"component":"@sveltejs/kit","cve_ids":["CVE-2026-82260"],"ecosystem":"npm","epss":0.00493,"exploited":false,"fixed_versions":["2.52.2"],"ghsa_id":"GHSA-vrhm-gvg7-fpcf","id":"tcs_01M5KGCVZ13YAADKT3292XNVB3","modified_at":"2026-09-02T03:55:42.139843995Z","published_at":"2026-02-19T20:29:42Z","references":["https://osv.dev/vulnerability/GHSA-vrhm-gvg7-fpcf","https://github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcf","https://github.com/sveltejs/kit/commit/f47c01bd8100328c24fdb8522fe35913b0735f35","https://github.com/sveltejs/kit","https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-vrhm-gvg7-fpcf","url":"https://osv.dev/vulnerability/GHSA-vrhm-gvg7-fpcf"}],"summary":"Memory exhaustion in SvelteKit remote form deserialization (experimental only)"}