Servers and applications

CVE-2026-128120

DoS while parsing form data from a remote functions `form`

Severity: High 7.5
Published: 29 Oct 2026
Last changed: 13 Nov 2026
Added to UpHeron: 13 Nov 2026
Fixed in: 3.1.1
Weakness: Inefficient algorithmic complexity (CWE-407)
Attack: Over the network · No login needed · No user action needed
Attacker can: Take it down
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Also known as: GHSA-3r8g-jcqq-3p5j
Sources: CVE Program, Project advisories (GitHub)

Description

This only affects applications using the experimental remote functions flag and utilizing the form, query, or command remote functions. A specially-crafted request could block the event loop for extended periods of time during parsing.

From sveltejs/kit's security advisory.

Affected software

Software	Affected versions
SvelteKitServers and applications · `cna:sveltejs\|kit`	From 2.42.0 before 3.1.1
SvelteKitServers and applications · `github:sveltejs/kit`	From 2.42.0 before 3.1.1

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-128120
GitHub Advisory Database https://github.com/advisories/GHSA-3r8g-jcqq-3p5j
github.com https://github.com/sveltejs/kit/security/advisories/GHSA-3r8g-jcqq-3p5j