8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22803

CVE-2026-22803: SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22803

CVE-2026-22803:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@sveltejs/kit	npm	>= 2.49.0, <= 2.49.4	2.49.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a memory amplification Denial of Service in the @sveltejs/kit package. The root cause lies in the deserialize_binary_form function located in packages/kit/src/runtime/form-utils.js. This function is responsible for parsing a custom binary format for form submissions. The vulnerability arises because the function reads a length field from the request payload and immediately allocates a memory buffer of that size without verifying if the request's total size (Content-Length) is consistent with the declared length. An attacker can exploit this by sending a request with a small body but a large value in the length field. This forces the server to allocate a large buffer, leading to memory exhaustion and a DoS condition. The provided patch addresses this by introducing two main changes. First, it adds checks to validate the lengths specified within the binary payload against the HTTP Content-Length header. Second, it refactors the data reading logic to accumulate incoming data into a list of smaller chunks and only allocates the final, large buffer after all the necessary data has been successfully received, thus preventing the premature, large memory allocation.

Vulnerable functions

deserialize_binary_form

packages/kit/src/runtime/form-utils.js

The vulnerability exists within the `deserialize_binary_form` function, specifically in a nested helper function `get_buffer`. The original code would read a `length` value from the incoming request's data stream and immediately allocate a `Uint8Array` of that size (`const buffer = new Uint8Array(length);`). An attacker could provide a large `length` value in the request payload without sending the corresponding amount of data, causing the server to eagerly allocate a large amount of memory, leading to memory exhaustion and a denial-of-service. The patch mitigates this by collecting the data in smaller chunks first and only allocating the final buffer after all data has been received. It also adds validation to check the declared length against the request's `Content-Length` header.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.