Is CVE-2026-82256 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82256 being exploited in the wild.

How severe is CVE-2026-82256?

Medium severity, with a CVSS score of 5.3, published 28 August 2026.

Which products and versions are affected?

@sveltejs/kit (npm) SEMVER:introduced=0,fixed=2.69.1; SvelteKit <= 2.69.0.

Is there a fix for CVE-2026-82256?

Yes. @sveltejs/kit (npm): upgrade to 2.69.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82256 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82256?

Check whether you run @sveltejs/kit (npm) or SvelteKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82256: SvelteKit unhandled promise rejection in form payload handling

Q: Is there a fix for CVE-2026-82256?

Yes. @sveltejs/kit (npm): upgrade to 2.69.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-82256 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-82256?

Check whether you run @sveltejs/kit (npm) or SvelteKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82256 · Severity: medium · CVSS 5.3 · Published 2026-08-28

SvelteKit is a popular web framework for building fast, interactive web applications. When a server receives a large remote form function payload, an unhandled promise rejection can crash the Node.js process, causing the application to become unavailable. Repeated attacks can result in sustained service disruption.

Technologies: @sveltejs/kit (npm), SvelteKit. Vendors: npm, Svelte.

Quick answers

Is CVE-2026-82256 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82256 being exploited in the wild.
How severe is CVE-2026-82256?: Medium severity, with a CVSS score of 5.3, published 28 August 2026.
Which products and versions are affected?: @sveltejs/kit (npm) SEMVER:introduced=0,fixed=2.69.1; SvelteKit <= 2.69.0.
Is there a fix for CVE-2026-82256?: Yes. @sveltejs/kit (npm): upgrade to 2.69.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82256 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82256?: Check whether you run @sveltejs/kit (npm) or SvelteKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@sveltejs/kit (npm): upgrade to 2.69.1 or later
```
npm install @sveltejs/kit@2.69.1
```

Technical details

The vulnerability is an unhandled promise rejection (CWE-248) in SvelteKit's form payload handling. When processing large remote form function payloads, the framework fails to catch promise rejections in certain code paths, allowing exceptions to propagate uncaught and terminate the Node.js process. The attack vector is network-based, requires no authentication or user interaction, and can be weaponized for denial-of-service by repeatedly sending oversized form payloads. The fix was applied in version 2.69.1 and later, which adds proper .catch() handlers to prevent unhandled rejections from crashing the process.

Affected products

Svelte SvelteKit <= 2.69.0

Identifiers

CVE-2026-82256
GHSA-wqjv-9729-c5q2

Timeline

2026-07-24: disclosed: GHSA-wqjv-9729-c5q2 published
2026-07-02: patched: Fix merged in PR #16219
2026-07-24: other: CVE-2026-82256 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.