CVE-2026-22803
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sveltejs | sveltekit | From 2.49.0 (inc) to 2.49.4 (inc) |
| sveltejs | sveltekit | 2.49.5 |
| sveltejs | adapter_node | 5.5.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-789 | The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22803 is a high-severity denial-of-service (DoS) vulnerability in the SvelteKit framework's experimental remote function form data deserializer. The vulnerability occurs because the server eagerly allocates memory based on a declared data length in a custom binary form payload without proper validation. An attacker can send a small payload with a large declared data length and then stall the connection, causing the server to allocate excessive memory and potentially exhaust server resources, leading to a DoS condition. [2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an unauthenticated remote attacker to cause your SvelteKit server to allocate large amounts of memory unnecessarily, leading to memory exhaustion. This can degrade server performance or crash the server, resulting in denial of service and making your web application unavailable to legitimate users. The attack is low complexity and requires only network access to repeatedly open connections and stall payload delivery. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusual or repeated connections to SvelteKit remote function endpoints that use the content type application/x-sveltekit-formdata, especially those that send a small payload with a large declared data length and then stall the connection. Network monitoring tools can be used to identify such suspicious requests. Additionally, inspecting server logs for errors related to memory allocation or deserialize errors may help detect exploitation attempts. Specific commands are not provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade SvelteKit to version 2.49.5 or later, where the vulnerability is fixed by adding strict validations on content length and preventing eager large memory allocations. Additionally, ensure that experimental.remoteFunctions is not exposed unnecessarily and monitor for suspicious remote form submissions. Applying the patch from the official release (@sveltejs/kit version 2.49.5) is the recommended action. [1, 2, 3]