---
id: 2026-02-sveltekit-remote-functions-cve-batch
title: "SvelteKit February–July 2026 advisory backfill — nine vendor advisories (three CVSS 8.7 remote-function DoS bugs, a cross-user query.batch data leak, a BODY_SIZE_LIMIT bypass, a ReDoS) that got CVE numbers only on 2026-08-28"
date_disclosed: 2026-02-18
last_updated: 2026-09-14
severity: high
status: patched
ecosystems: [npm, javascript, svelte]
tools_affected: ["@sveltejs/kit", "@sveltejs/adapter-node", "SvelteKit apps using experimental.remoteFunctions"]
tags: [cve-batch, dos, memory-exhaustion, cpu-exhaustion, deserialization, prototype-pollution, cross-user-data-leak, redos, body-size-limit, sveltekit, backfill]
---

## TL;DR
Between **2026-02-18 and 2026-07-29** the SvelteKit team published **nine security advisories** on its own GitHub advisory tab — none announced on the Svelte blog, unlike the January batch this repo already tracks. Six of them received CVE ids from **VulnCheck (as CNA) on 2026-08-28**, and NVD scores three of the remote-function denial-of-service bugs at **CVSS 4.0 8.7 (High)** where the vendor labelled them Moderate or Low. One more, a **cross-user data leak in `query.batch`** (CVE-2026-82258), is the only confidentiality issue in the set. Everything is fixed: **`@sveltejs/kit` ≥ 2.70.2** closes all nine. If you upgraded after the January CVEs and stopped, you are still on a vulnerable line.

## What happened

This repo's [January 2026 Svelte batch](2026-01-svelte-ecosystem-cve-batch.md) covered five CVEs the Svelte team announced in a blog post, including **CVE-2026-22803** (memory-amplification DoS in the experimental Remote Functions binary form deserializer, fixed 2.49.5). The vendor kept finding bugs in the same deserializer and kept publishing advisories — but only on `github.com/sveltejs/kit/security/advisories`, with no blog post, and (for most) no CVE at the time. VulnCheck assigned CVEs to six of them in one go on 2026-08-28, which is when they surfaced in this sweep's advisory-database query. Per this repo's standing rule, they are dated here by the **vendor's original publication date**, not the CVE date.

| Vendor advisory (original date) | CVE (assigned) | Vendor label | NVD score | Affected `@sveltejs/kit` | Fixed |
|---|---|---|---|---|---|
| [GHSA-vrhm-gvg7-fpcf](https://github.com/sveltejs/kit/security/advisories) (2026-02-18) — memory exhaustion in remote form deserialization | CVE-2026-82260 (2026-08-28) | Moderate | **8.7 High** | ≥ 2.49.0, ≤ 2.52.1 | 2.52.2 |
| GHSA-88qp-p4qg-rqm6 (2026-02-18) — CPU exhaustion in remote form deserialization | CVE-2026-82261 (2026-08-28) | Moderate | **8.7 High** | ≥ 2.49.0, ≤ 2.52.1 | 2.52.2 |
| GHSA-fpg4-jhqr-589c (2026-02-26) — deserialization expansion in unvalidated form remote function | CVE-2026-82259 (2026-08-28) | **Low** | **8.7 High** | 2.49.0 – 2.53.2 | 2.53.3 |
| [GHSA-2crg-3p73-43xp](https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp) (2026-04-09) — `BODY_SIZE_LIMIT` bypass on adapter-node | CVE-2026-40073 (2026-04-10) | Moderate 6.3 | **8.2 High** | ≤ 2.57.0 (adapter-node deployments) | 2.57.1 |
| [GHSA-3f6h-2hrp-w5wx](https://github.com/sveltejs/kit/security/advisories/GHSA-3f6h-2hrp-w5wx) (2026-04-09) — unvalidated `redirect()` in `handle` hook throws unhandled `TypeError` | CVE-2026-40074 | Moderate 6.3 | — | ≤ 2.57.0 | 2.57.1 |
| [GHSA-hgv7-v322-mmgr](https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr) (2026-05-14) — `query.batch` cross-talk | CVE-2026-82258 (2026-08-28) | Moderate 5.9 | 5.9 Medium | ≥ 2.38.0, ≤ 2.60.0 | 2.60.1 |
| GHSA-wqjv-9729-c5q2 (2026-07-02) — big remote form payloads crash the Node process | CVE-2026-82256 (2026-08-28) | Moderate | 6.9 Medium | < 2.69.1 | 2.69.1 |
| GHSA-866w-xmhq-wj7x (2026-07-02) — prototype pollution in file-input deletion path | CVE-2026-82257 (2026-08-28) | Moderate | 5.3 Medium | < 2.69.1 | 2.69.1 |
| [GHSA-29g2-3rmr-qm68](https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68) (2026-07-29) — ReDoS in content-negotiation `Accept` header parsing | CVE-2026-66062 | Moderate 5.3 | — | < 2.70.1 (page states patched 2.70.2) | 2.70.2 |

Details worth knowing:

- **The three 8.7s are all the same feature.** `experimental.remoteFunctions` with the `form` remote function deserialises attacker-supplied form data; malformed input exhausts memory (82260), CPU (82261), or — if the app processes the `files` array without validating `files.length` or per-file size — expands a small request into a very large file array (82259). Only apps that opted into the experimental feature are exposed, but that is exactly the feature SvelteKit's own docs push for new apps, and the fix version moved three times (2.49.5 → 2.52.2 → 2.53.3) as new variants were found.
- **`query.batch` cross-talk is a data leak, not a DoS.** Under specific timing, concurrent requests from *different users* could be merged into one request context, so one user could see another's data. Reported by rafabd1; fixed in 2.60.1. If you use `query.batch()` on anything user-scoped, this is the one to check logs for.
- **`BODY_SIZE_LIMIT` bypass** lets requests exceed the configured body limit on adapter-node deployments. The vendor's own note: limits enforced at a WAF, gateway or platform layer are unaffected — so this matters most for the "one Node process on a VPS" deployments vibe-coding platforms emit.
- **Severity disagreement, again.** The vendor labelled 82259 *Low* and 82260/82261 *Moderate*; VulnCheck scored all three 8.7 and NVD carries that. This repo's standing rule (prefer the numeric score when a vendor's qualitative label and a CNA's CVSS disagree) is why this advisory is `high`.
- **Two GHSA ids per CVE.** For 82259/82260/82261 the vendor-repo advisories (GHSA-fpg4-jhqr-589c, GHSA-vrhm-gvg7-fpcf, GHSA-88qp-p4qg-rqm6) and the GitHub Advisory Database's separate, "unreviewed" VulnCheck-sourced entries ([GHSA-7jhg-723h-fjhx](https://github.com/advisories/GHSA-7jhg-723h-fjhx), [GHSA-33c7-c62f-7cc2](https://github.com/advisories/GHSA-33c7-c62f-7cc2), [GHSA-xjpx-7387-jh7h](https://github.com/advisories/GHSA-xjpx-7387-jh7h)) carry different ids for the same bugs. Grep for the CVE, not the GHSA.
- **No Svelte blog post.** [svelte.dev/blog](https://svelte.dev/blog) has no security post between the January CVE roundup and 2026-09-14; the August and September posts are the SvelteKit 3 release candidate and a "what's new." The advisory tab is the only vendor record.

## Am I affected?

```bash
npm ls @sveltejs/kit @sveltejs/adapter-node 2>/dev/null
grep -rn 'remoteFunctions' svelte.config.* 2>/dev/null     # experimental feature on?
grep -rn 'query.batch' src/ 2>/dev/null                     # cross-user leak surface
```

- `@sveltejs/kit` **< 2.70.2** → affected by at least one item above. **2.52.2 / 2.53.3 / 2.57.1 / 2.60.1 / 2.69.1 / 2.70.2** are the successive fix lines; the last covers everything.
- Apps that never enabled `experimental.remoteFunctions` are not exposed to the three 8.7s or the two 2.69.1 items, but are still exposed to the `BODY_SIZE_LIMIT` bypass (adapter-node), the `redirect()` DoS, the `query.batch` leak and the ReDoS.

## If you are affected

1. `npm install @sveltejs/kit@latest` (≥ 2.70.2) and redeploy; if you are on the SvelteKit 3 release candidate, confirm it is at or past the equivalent fixes before assuming.
2. If you use `query.batch()` with per-user data and ran ≥ 2.38.0 < 2.60.1 in production, review access logs for the affected window; this is the one item with a confidentiality impact.
3. Add `files.length` and per-file size validation to any `form` remote function regardless of version — the fix caps the deserializer, not your handler.
4. → [playbooks/if-your-webapp-was-compromised.md](../playbooks/if-your-webapp-was-compromised.md) if you find evidence of exploitation.

## Prevention
→ [prevention/supply-chain-attack-surface.md](../prevention/supply-chain-attack-surface.md)
→ Watch `github.com/sveltejs/kit/security/advisories` directly. The January batch got a blog post; the next nine advisories did not, and six of them had no CVE for up to six months — a CVE-driven scanner would have shown a clean bill for the whole period.

## Sources
- [sveltejs/kit — Security Advisories index](https://github.com/sveltejs/kit/security/advisories) — fetched 2026-09-14: the nine advisories with the vendor's original publication dates and severity labels.
- [GHSA-3f6h-2hrp-w5wx (CVE-2026-40074)](https://github.com/sveltejs/kit/security/advisories/GHSA-3f6h-2hrp-w5wx), [GHSA-2crg-3p73-43xp (CVE-2026-40073)](https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp), [GHSA-hgv7-v322-mmgr](https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr), [GHSA-29g2-3rmr-qm68 (CVE-2026-66062)](https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68) — vendor advisory pages fetched 2026-09-14: descriptions, vendor CVSS, affected/patched versions, credits.
- [GitHub Advisory Database — GHSA-7jhg-723h-fjhx (CVE-2026-82259)](https://github.com/advisories/GHSA-7jhg-723h-fjhx), [GHSA-33c7-c62f-7cc2 (CVE-2026-82260)](https://github.com/advisories/GHSA-33c7-c62f-7cc2), [GHSA-xjpx-7387-jh7h (CVE-2026-82261)](https://github.com/advisories/GHSA-xjpx-7387-jh7h) — fetched 2026-09-14: the VulnCheck-sourced database entries, CVSS 8.7, affected/fixed ranges, 2026-08-28 database dates.
- NVD API records, fetched 2026-09-14: [CVE-2026-82256](https://nvd.nist.gov/vuln/detail/CVE-2026-82256), [CVE-2026-82257](https://nvd.nist.gov/vuln/detail/CVE-2026-82257), [CVE-2026-82258](https://nvd.nist.gov/vuln/detail/CVE-2026-82258), [CVE-2026-82259](https://nvd.nist.gov/vuln/detail/CVE-2026-82259), [CVE-2026-82260](https://nvd.nist.gov/vuln/detail/CVE-2026-82260), [CVE-2026-82261](https://nvd.nist.gov/vuln/detail/CVE-2026-82261), [CVE-2026-40073](https://nvd.nist.gov/vuln/detail/CVE-2026-40073) — CNA (VulnCheck for the 8225x/8226x series, GitHub for 40073), publication dates, CVSS 4.0 scores, affected-range text.
- [npm registry — `@sveltejs/kit`](https://registry.npmjs.org/@sveltejs/kit) — queried 2026-09-14 (`npm view @sveltejs/kit time`): 2.52.2 (2026-02-18), 2.53.3 (2026-02-26), 2.57.1 (2026-04-09) — release dates match the vendor advisory dates.
- [Svelte blog index](https://svelte.dev/blog) — fetched 2026-09-14: confirms no security post covering these advisories.