Description (CNA)
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| sveltejs / kit | affected 2.49.0 before 2.52.1; unaffected 2.52.1 |
CWE
CWE-400
References
- https://github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6
- https://www.vulncheck.com/advisories/sveltekit-before-2.52.2-cpu-exhaustion-via-remote-form-deserialization
ADP enrichment
No English description supplied.
No references supplied.