CVE-2026-22803: SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer
Vulnerability summary
CVE-2026-22803 is a high (CVSS 8.2) vulnerability in svelte kit. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 48.2% of scored vulnerabilities.
Severe, CVSS 8.2 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 15-01-2026PublishedVulnerability first disclosed.
- 15-01-2026Last modifiedVulnerability information updated.
Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · NpmEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.59%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 0.60% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
@sveltejs1 product
- kit≥ 2.49.0, < 2.49.5
Svelte1 product
- kit≥ 2.49.0, < 2.49.5
Sveltejs1 product
- kit≥ 2.49.0, < 2.49.5
3 vendors · 3 products
References
6 links- github.com/sveltejs/kit/security/advisories/GHSA-j2f3-wq62-6q46X Refsource CONFIRMWEBVendor Advisory
- github.com/sveltejs/kitPACKAGE