CVE-2026-128120

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.42.0 until 3.1.1, applications using the experimental remote functions flag and a remote form function could perform quadratic synchronous work while parsing a specially crafted request with many form entries. The parsing work could block the event loop for an extended period and deny service. This issue is fixed in 3.1.1.

• CWE-407

• https://github.com/sveltejs/kit/commit/24d8ee409d83c438330ff2850b4f159c1222aa27
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1
• https://github.com/sveltejs/kit/security/advisories/GHSA-3r8g-jcqq-3p5j

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12811A weakness has been identified in kortix-ai suna up to 0.8.3…4.3
• CVE-2026-128116SvelteKit is a framework for rapidly developing robust, perf…5.3
• CVE-2026-128117SvelteKit is a framework for rapidly developing robust, perf…5.9
• CVE-2026-128118SvelteKit is a framework for rapidly developing robust, perf…7.5
• CVE-2026-128119SvelteKit is a framework for rapidly developing robust, perf…5.9
• CVE-2026-12812A security vulnerability has been detected in Radware Cyber …3.5
• CVE-2026-128121SvelteKit is a framework for rapidly developing robust, perf…5.9
• CVE-2026-128122SvelteKit is a framework for rapidly developing robust, perf…5.9
• CVE-2026-128123SvelteKit is a framework for rapidly developing robust, perf…5.9
• CVE-2026-128124AIOHTTP is an asynchronous HTTP client/server framework for …8.2
• CVE-2026-128125AIOHTTP is an asynchronous HTTP client/server framework for …6.3
• CVE-2026-128126AIOHTTP is an asynchronous HTTP client/server framework for …8.7