CVE-2026-22803: @sveltejs/kit Denial of Service Vulnerability
HIGHCVE-2026-22803 is a HIGH denial of service vulnerability (CWE-789: Memory Allocation with Excessive Size Value) affecting @sveltejs/kit libraries in the npm ecosystem. The issue involves @sveltejs/kit has memory amplification dos vulnerability in remote functions binary form deserializer (application/x-sveltekit-formdata). Remediation is available by upgrading affected packages to version 2.49.5.
CVE-2026-22803 at a Glance
How to Fix CVE-2026-22803
To remediate this vulnerability, upgrade all affected @sveltejs/kit dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @sveltejs/kit@2.49.5Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @sveltejs/kitHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-22803, inspect your project dependencies using npm:
npm ls @sveltejs/kitAnalyze the terminal output to locate any version of @sveltejs/kit in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.49.5), your application is affected.
Note: The npm ls @sveltejs/kit command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-789: Memory Allocation with Excessive Size Value, where the product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. In @sveltejs/kit, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-22803 Affected @sveltejs/kit Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@sveltejs/kit
|
npm |
≥ 2.49.0
< 2.49.5
|
2.49.5
|
References
Frequently Asked Questions
What is CVE-2026-22803?
Which @sveltejs/kit versions are affected?
What version fixes CVE-2026-22803?
Is @sveltejs/kit affected?
What CWE is associated with CVE-2026-22803?
How can I check npm dependencies for CVE-2026-22803?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-j2f3-wq62-6q46",
"modified" : "2026-01-15T22:33:44Z",
"published" : "2026-01-15T18:10:52Z",
"aliases" : [ "CVE-2026-22803" ],
"summary" : "@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)",
"details" : "## Summary\n\nThe experimental `form` remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion.\n\n## Details\n\nWhen a form is submitted to a remote function endpoint, the SvelteKit client encodes the data using a custom format, and POSTs it to the endpoint as a request with an `application/x-sveltekit-formdata` content type.\n\nThe first few bytes of the request body encode the length of the data. SvelteKit will attempt to read the request body up until the specified offset, but if the body is not yet available then an array buffer of that size will be created eagerly to accommodate it as it arrives.\n\nAn attacker can force this code path by sending a small payload that specifies a large data length, then stalling the connection. The resulting array buffer will be held in memory, potentially causing memory exhaustion.\n\n## Impact\n\n- Vulnerability type: Availability / memory exhaustion (memory amplification).\n- Who is impacted: SvelteKit apps with `experimental.remoteFunctions` enabled, and that expose a reachable Remote Form endpoint.\n- Attack: an unauthenticated attacker can repeatedly open connections, send only the 8-byte header/prefix (with large data_length), and stall the body to hold large allocations, exhausting memory.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@sveltejs/kit"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.49.0"
}, {
"fixed" : "2.49.5"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 2.49.4"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/sveltejs/kit/security/advisories/GHSA-j2f3-wq62-6q46"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-22803"
}, {
"type" : "WEB",
"url" : "https://github.com/sveltejs/kit/commit/8ed8155215b9a74012fecffb942ad9a793b274e5"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/sveltejs/kit"
}, {
"type" : "WEB",
"url" : "https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.49.5"
}, {
"type" : "WEB",
"url" : "https://github.com/sveltejs/kit/releases/tag/@sveltejs%2Fadapter-node@5.5.1"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-789" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-01-15T18:10:52Z",
"nvd_published_at" : "2026-01-15T19:16:06Z"
}
}