CVE-2026-22803

Katalog CVE

CVSS 7.5 · High EPSS 0,59%

Kerentanan Memory Allocation with Excessive Size Value pada svelte kit. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.

Rincian

Terbit di NVD

15 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-789: Memory Allocation with Excessive Size Value
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sveltejs/kit/security/advisories/GHSA-j2f3-wq62-6q46 advisory vendor
• https://github.com/sveltejs/kit/commit/8ed8155215b9a74012fecffb942ad9a793b274e5 patch
• https://github.com/sveltejs/kit/releases/tag/@sveltejs%2Fadapter-node@5.5.1 release notes