SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.42.0 until 3.1.1, applications using the experimental remote functions flag and a remote form function could perform quadratic synchronous work while parsing a specially crafted request with many form entries. The parsing work could block the event loop for an extended period and deny service. This issue is fixed in 3.1.1.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 13 Nov 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.42.0 until 3.1.1, applications using the experimental remote functions flag and a remote form function could perform quadratic synchronous work while parsing a specially crafted request with many form entries. The parsing work could block the event loop for an extended period and deny service. This issue is fixed in 3.1.1. | |
| Title | SvelteKit: DoS while parsing form data from a remote functions `form` | |
| Weaknesses | CWE-407 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-11-13T19:34:08.320Z
Reserved: 2026-11-12T22:42:47.031Z
Link: CVE-2026-128120
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses