# CVE-2026-82256: SvelteKit unhandled promise rejection in form payload handling

Source: https://junglewise.ai/threats/cve-2026-82256-sveltekit-unhandled-promise-rejection-in-form-payload-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82256 · Severity: medium · CVSS 5.3 · Published 2026-08-28

SvelteKit is a popular web framework for building fast, interactive web applications. When a server receives a large remote form function payload, an unhandled promise rejection can crash the Node.js process, causing the application to become unavailable. Repeated attacks can result in sustained service disruption.

Technologies: [@sveltejs/kit (npm)](https://junglewise.ai/threats/technologies/sveltejs-kit), [SvelteKit](https://junglewise.ai/threats/technologies/sveltekit). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Svelte](https://junglewise.ai/threats/vendors/svelte).

## Quick answers

**Is CVE-2026-82256 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82256 being exploited in the wild.

**How severe is CVE-2026-82256?** Medium severity, with a CVSS score of 5.3, published 28 August 2026.

**Which products and versions are affected?** @sveltejs/kit (npm) SEMVER:introduced=0,fixed=2.69.1; SvelteKit <= 2.69.0.

**Is there a fix for CVE-2026-82256?** Yes. @sveltejs/kit (npm): upgrade to 2.69.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82256 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82256?** Check whether you run @sveltejs/kit (npm) or SvelteKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @sveltejs/kit (npm): upgrade to 2.69.1 or later

  ```sh
  npm install @sveltejs/kit@2.69.1
  ```


## Technical details

The vulnerability is an unhandled promise rejection (CWE-248) in SvelteKit's form payload handling. When processing large remote form function payloads, the framework fails to catch promise rejections in certain code paths, allowing exceptions to propagate uncaught and terminate the Node.js process. The attack vector is network-based, requires no authentication or user interaction, and can be weaponized for denial-of-service by repeatedly sending oversized form payloads. The fix was applied in version 2.69.1 and later, which adds proper .catch() handlers to prevent unhandled rejections from crashing the process.

## Affected products

- Svelte SvelteKit <= 2.69.0

## Identifiers

- CVE-2026-82256
- GHSA-wqjv-9729-c5q2

## Timeline

- 2026-07-24: disclosed: GHSA-wqjv-9729-c5q2 published
- 2026-07-02: patched: Fix merged in PR #16219
- 2026-07-24: other: CVE-2026-82256 assigned

## References

- [https://github.com/sveltejs/kit/security/advisories/GHSA-wqjv-9729-c5q2](https://github.com/sveltejs/kit/security/advisories/GHSA-wqjv-9729-c5q2)
- [https://github.com/sveltejs/kit/pull/16219](https://github.com/sveltejs/kit/pull/16219)

## Related threats

- [SvelteKit XSS via cache-control header in prerendered pages](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-xss-via-cache-control-header-5731f4e1)
- [SvelteKit open redirect in enhanced form actions](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-open-redirect-via-enhanced-9a8dcd94)
- [SvelteKit path traversal in vite preview server on Windows](https://junglewise.ai/threats/cve-2026-114063-sveltekit-sveltejs-kit-from-2-10-0-before-3-0-0-contains-a-path)
- [SvelteKit server-side request forgery in self-fetch fallbacks](https://junglewise.ai/threats/cve-2026-114062-sveltekit-before-3-0-0-contains-a-server-side-request-forgery)
- [SvelteKit cross-site scripting in prerendered pages](https://junglewise.ai/threats/cve-2026-114061-sveltekit-sveltejs-kit-before-3-0-0-contains-a-cross-site)