Executive brief
SvelteKit is a popular web framework for building fast, interactive web applications. When a server receives a large remote form function payload, an unhandled promise rejection can crash the Node.js process, causing the application to become unavailable. Repeated attacks can result in sustained service disruption.
Technical details
The vulnerability is an unhandled promise rejection (CWE-248) in SvelteKit's form payload handling. When processing large remote form function payloads, the framework fails to catch promise rejections in certain code paths, allowing exceptions to propagate uncaught and terminate the Node.js process. The attack vector is network-based, requires no authentication or user interaction, and can be weaponized for denial-of-service by repeatedly sending oversized form payloads. The fix was applied in version 2.69.1 and later, which adds proper .catch() handlers to prevent unhandled rejections from crashing the process.
Affected products
- Svelte SvelteKit <= 2.69.0
Timeline
- 2026-07-24: disclosed: GHSA-wqjv-9729-c5q2 published
- 2026-07-02: patched: Fix merged in PR #16219
- 2026-07-24: other: CVE-2026-82256 assigned