CVE-2026-82259

Katalog CVE

CVSS 7.5 · High EPSS 0,53%

Kerentanan Deserialization of Untrusted Data pada sveltekit. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.

Rincian

Terbit di NVD

28 Agustus 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c advisory vendor
• https://www.vulncheck.com/advisories/sveltekit-2.49.0-before-2.53.3-denial-of-service-via-form advisory pihak ketiga