Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. @sveltejs/kit
  4. ›
  5. GHSA-vrhm-gvg7-fpcf

GHSA-vrhm-gvg7-fpcf: Memory exhaustion in SvelteKit remote form deserialization (experimental only)

February 19, 2026

Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.

Only applications using both experimental.remoteFunctions and form are vulnerable.

References

  • github.com/advisories/GHSA-vrhm-gvg7-fpcf
  • github.com/sveltejs/kit
  • github.com/sveltejs/kit/commit/f47c01bd8100328c24fdb8522fe35913b0735f35
  • github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2
  • github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcf

Code Behaviors & Features

Detect and mitigate GHSA-vrhm-gvg7-fpcf with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 2.49.0 before 2.52.2

Fixed versions

  • 2.52.2

Solution

Upgrade to version 2.52.2 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-770: Allocation of Resources Without Limits or Throttling

Source file

npm/@sveltejs/kit/GHSA-vrhm-gvg7-fpcf.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 25 Mar 2026 00:19:10 +0000.