CVE-2026-128120
Received Received - Intake

Remote Form Quadratic Work Denial of Service in SvelteKit

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.42.0 until 3.1.1, applications using the experimental remote functions flag and a remote form function could perform quadratic synchronous work while parsing a specially crafted request with many form entries. The parsing work could block the event loop for an extended period and deny service. This issue is fixed in 3.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128120
EUVD
EUVD-2026-125732

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
svelte sveltekit 3.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SvelteKit versions between 2.42.0 and 3.1.1. When the experimental remote functions flag and a remote form function are enabled, a specially crafted request with many form entries can cause quadratic synchronous parsing work. This blocks the event loop for a long time, leading to a denial of service.

Impact Analysis

If you use SvelteKit in the affected versions with the experimental remote functions enabled, an attacker could send a malicious request to crash or slow down your application. This disrupts service for legitimate users and may cause downtime.

Mitigation Strategies

Upgrade SvelteKit to version 3.1.1 or later to address the vulnerability. Avoid using the experimental remote functions flag and remote form function until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128120. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...