CVE-2026-82256
Last modified
CVE-2026-82256 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Svelte | Sveltekit | < 2.69.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-82256?
How severe is CVE-2026-82256?
How do I fix CVE-2026-82256?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-82250gitoxide gix-packetline versions before 0.21.5 contain a pan…6.5
- CVE-2026-82251gitoxide before 0.52.1 fails to validate submodule names fro…7.5
- CVE-2026-82252gitoxide before 0.52.1 follows symlinks when reading the wor…7.5
- CVE-2026-82253gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10…7.5
- CVE-2026-82254gitoxide before 0.69.0 contains unchecked array indexing in …7.5
- CVE-2026-82255gitoxide versions from 0.25.4 contain an HTTP credential lea…6.8
- CVE-2026-82257SvelteKit versions before 2.69.1 contain a prototype polluti…4.3
- CVE-2026-82258SvelteKit versions from 2.38.0 before 2.60.1 contain a race …4.8
- CVE-2026-82259SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53…7.5
- CVE-2026-8226A security flaw has been discovered in Open5GS up to 2.7.7. …7.5
- CVE-2026-82260SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 wit…7.5
- CVE-2026-82261SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 wit…7.5
Are you affected by CVE-2026-82256?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST