GHSA-wqjv-9729-c5q2

Summary

SvelteKit: Big remote form function payloads can cause Node process to crash

Severity

medium

CVSS

5.3

CWE

CWE-248

Published

2026-07-24

Updated

2026-07-24

Advisory details

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.

References

• https://github.com/advisories/GHSA-wqjv-9729-c5q2
• https://github.com/sveltejs/kit/security/advisories/GHSA-wqjv-9729-c5q2
• https://github.com/sveltejs/kit/pull/16219
• https://github.com/sveltejs/kit/commit/82b0370c793ac392cee5c2e28f4b8fed09c64582
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.69.1
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0-next.7

Related advisories

• CVE-2026-40073 — high · npm/@sveltejs/kit
• CVE-2026-66062 — medium · npm/@sveltejs/kit
• GHSA-866w-xmhq-wj7x — medium · npm/@sveltejs/kit
• GHSA-hgv7-v322-mmgr — medium · npm/@sveltejs/kit
• CVE-2026-40074 — medium · npm/@sveltejs/kit
• CVE-2026-92954 — critical · npm/vm2
• CVE-2026-109869 — high · npm/undici
• CVE-2026-113872 — high · npm/multer

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity