Executive brief
SvelteKit is a popular framework for building web applications. A vulnerability exists where sending excessively large data payloads to certain form functions can cause the underlying server process to crash. An attacker could exploit this to repeatedly shut down the application, leading to a denial of service for legitimate users.
Technical details
A vulnerability in SvelteKit's handling of remote form functions allows for a Denial of Service (DoS) attack. The root cause is an unhandled promise rejection (CWE-248) when processing large or malformed payloads. Specifically, if a promise fails during the execution of a remote form function and the error is not caught, the Node.js process may terminate. An unauthenticated remote attacker can trigger this by sending a large payload to a vulnerable endpoint. The issue has been addressed by adding proper error handling (.catch blocks) to the affected code paths in the runtime and server components. Users should upgrade to version 2.69.1 or later.
Affected products
- Svelte SvelteKit <= 2.69.0
Timeline
- 2026-07-02: patched: Fix merged in PR #16219
- 2026-07-24: advisory: GitHub Advisory GHSA-wqjv-9729-c5q2 published
References
- https://github.com/sveltejs/kit/security/advisories/GHSA-wqjv-9729-c5q2
- https://github.com/sveltejs/kit/pull/16219
- https://github.com/sveltejs/kit/commit/82b0370c793ac392cee5c2e28f4b8fed09c64582
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.69.1
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0-next.7
- https://api.github.com/repos/sveltejs/kit/security-advisories/GHSA-wqjv-9729-c5q2