---
cve: "CVE-2026-82259"
severity: "HIGH"
cvss: 8.7
epss: "0.5%"
vendor: "sveltejs"
kev: false
exploited: false
published: "2026-08-28 12:16:38"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-25T11:18:45+01:00"
---

# CVE-2026-82259

> 8.7 HIGH · 🧪 PoC

## Beschreibung

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-10-08 15:25:30
- CNA-CVSS: **8.7** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-502** — Deserialization of Untrusted Data
  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

## Angriffsmuster (CAPEC)

- [CAPEC-586 — Object Injection](https://capec.mitre.org/data/definitions/586.html) _(Severity: High)_

## Patch verfügbar (OSV)

- 66d88c93da40c48cf3f4aca871d74a4fc7ff3990 (Commit)

## Referenzen

- <https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c>
- <https://www.vulncheck.com/advisories/sveltekit-2.49.0-before-2.53.3-denial-of-service-via-form>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-82259/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_