What is GHSA-xjpx-7387-jh7h?

GHSA-xjpx-7387-jh7h is a security advisory published by GitHub Security Advisories with High severity. SvelteKit (@sveltejs/kit) versions \u003e=2.49.0 and \u003c=2.52.1 with experimental remote functions and...

Which CVE IDs does GHSA-xjpx-7387-jh7h cover?

GHSA-xjpx-7387-jh7h covers the following CVE IDs: CVE-2026-82261. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xjpx-7387-jh7h?

GHSA-xjpx-7387-jh7h has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-xjpx-7387-jh7hHighCVSS 7.5

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and...

Vendor

GitHub Security Advisories

Published

August 28, 2026

Last Modified

August 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-82261 →

📋 Description

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.

🔗 References (4)

https://github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6
https://nvd.nist.gov/vuln/detail/CVE-2026-82261
https://www.vulncheck.com/advisories/sveltekit-before-2.52.2-cpu-exhaustion-via-remote-form-deserialization
https://github.com/advisories/GHSA-xjpx-7387-jh7h