Description (CNA)
SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| sveltejs / kit | affected 0 before 2.69.1; unaffected 2.69.1 |
CWE
CWE-400
References
- https://github.com/sveltejs/kit/security/advisories/GHSA-wqjv-9729-c5q2
- https://www.vulncheck.com/advisories/sveltekit-before-2.69.1-denial-of-service-via-remote-form
ADP enrichment
No English description supplied.
No references supplied.