Denial of Service Vulnerability in SvelteKit Framework by Svelte

CVE-2026-128120

What is CVE-2026-128120?

The SvelteKit framework has a vulnerability that allows for denial of service through its experimental remote functions and remote form functions. Applications using SvelteKit versions 2.42.0 to 3.1.1 may encounter significant parsing delays while processing specially crafted requests with an excessive number of form entries. This excessive load can block the event loop for extended periods, potentially leading to a denial of service condition. Users are advised to upgrade to SvelteKit version 3.1.1 or later to mitigate this risk. For more information, please refer to the GitHub advisory and the release notes.

References