Memory Exhaustion Vulnerability in SvelteKit by Svelte

CVE-2026-22803

What is CVE-2026-22803?

A memory exhaustion vulnerability exists in SvelteKit, affecting versions 2.49.0 to 2.49.4. The issue stems from the experimental form remote function, which utilizes a binary data format to handle submitted form data. An attacker can exploit this by sending a specially-crafted payload that causes the server to allocate excessive memory, leading to a denial of service through memory exhaustion. Users are advised to update to version 2.49.5 or later to mitigate this risk.

References