{"id":"CVE-2026-128120","summary":"SvelteKit: DoS while parsing form data from a remote functions `form`","details":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.42.0 until 3.1.1, applications using the experimental remote functions flag and a remote form function could perform quadratic synchronous work while parsing a specially crafted request with many form entries. The parsing work could block the event loop for an extended period and deny service. This issue is fixed in 3.1.1.","aliases":["GHSA-3r8g-jcqq-3p5j"],"modified":"2026-11-15T02:46:33.591669870Z","published":"2026-11-13T19:34:08.320Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128120.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-407"]},"references":[{"type":"WEB","url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128120.json"},{"type":"ADVISORY","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-3r8g-jcqq-3p5j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128120"},{"type":"FIX","url":"https://github.com/sveltejs/kit/commit/24d8ee409d83c438330ff2850b4f159c1222aa27"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sveltejs/kit","events":[{"introduced":"3de8e38010b8ecb8243b4ff47541c6d9a94805f8"},{"fixed":"4a75141ca7fab2ad70e472203c81adef0dea90a2"},{"fixed":"24d8ee409d83c438330ff2850b4f159c1222aa27"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"2.42.0"},{"fixed":"3.1.1"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"24d8ee409d83c438330ff2850b4f159c1222aa27"}]}]}}],"versions":["@sveltejs/package@3.0.1","@sveltejs/kit@3.1.0","@sveltejs/adapter-vercel@7.0.1","@sveltejs/adapter-cloudflare@8.0.1","@sveltejs/kit@3.0.1","@sveltejs/adapter-netlify@7.0.1","@sveltejs/package@3.0.0","@sveltejs/kit@3.0.0","@sveltejs/enhanced-img@1.0.0","@sveltejs/adapter-vercel@7.0.0","@sveltejs/adapter-static@4.0.0","@sveltejs/adapter-node@6.0.0","@sveltejs/adapter-netlify@7.0.0","@sveltejs/adapter-cloudflare@8.0.0","@sveltejs/adapter-bun@1.0.0","@sveltejs/adapter-auto@8.0.0","@sveltejs/kit@2.70.3","@sveltejs/kit@2.70.2","@sveltejs/kit@2.70.1","@sveltejs/kit@2.70.0","@sveltejs/kit@2.69.3","@sveltejs/kit@2.69.2","@sveltejs/kit@2.69.1","@sveltejs/kit@2.69.0","@sveltejs/kit@2.68.0","@sveltejs/adapter-node@5.5.7","@sveltejs/kit@2.67.0","@sveltejs/adapter-node@5.5.6","@sveltejs/kit@2.66.0","@sveltejs/enhanced-img@0.11.0","@sveltejs/adapter-vercel@6.3.4","@sveltejs/adapter-node@5.5.5","@sveltejs/kit@2.65.2","@sveltejs/adapter-cloudflare@7.2.9","@sveltejs/kit@2.65.1","@sveltejs/kit@2.65.0","@sveltejs/kit@2.64.0","@sveltejs/kit@2.63.1","@sveltejs/kit@2.63.0","@sveltejs/package@2.5.8","@sveltejs/kit@2.62.0","@sveltejs/kit@2.61.1","@sveltejs/kit@2.61.0","@sveltejs/kit@2.60.1","@sveltejs/kit@2.60.0","@sveltejs/kit@2.59.1","@sveltejs/kit@2.59.0","@sveltejs/kit@2.58.0","@sveltejs/kit@2.57.1","@sveltejs/kit@2.57.0","@sveltejs/kit@2.56.1","@sveltejs/kit@2.56.0","@sveltejs/kit@2.55.0","@sveltejs/enhanced-img@0.10.4","@sveltejs/kit@2.54.0","@sveltejs/kit@2.53.4","@sveltejs/kit@2.53.3","@sveltejs/adapter-node@5.5.4","@sveltejs/kit@2.53.2","@sveltejs/kit@2.53.1","@sveltejs/adapter-vercel@6.3.3","@sveltejs/adapter-netlify@6.0.4","@sveltejs/adapter-netlify@6.0.3","@sveltejs/kit@2.53.0","@sveltejs/enhanced-img@0.10.3","@sveltejs/kit@2.52.2","@sveltejs/adapter-vercel@6.3.2","@sveltejs/adapter-netlify@6.0.2","@sveltejs/adapter-cloudflare@7.2.8","@sveltejs/kit@2.52.0","@sveltejs/adapter-auto@7.0.1","@sveltejs/enhanced-img@0.10.2","@sveltejs/kit@2.51.0","@sveltejs/enhanced-img@0.10.1","@sveltejs/adapter-node@5.5.3","@sveltejs/adapter-netlify@6.0.0","@sveltejs/adapter-cloudflare@7.2.7","@sveltejs/kit@2.50.2","@sveltejs/enhanced-img@0.10.0","@sveltejs/kit@2.50.1","@sveltejs/adapter-vercel@6.3.1","@sveltejs/adapter-node@5.5.2","@sveltejs/adapter-cloudflare@7.2.6","@sveltejs/kit@2.50.0","@sveltejs/enhanced-img@0.9.3","@sveltejs/kit@2.49.5","@sveltejs/adapter-node@5.5.1","@sveltejs/adapter-cloudflare@7.2.5","@sveltejs/adapter-node@5.5.0","@sveltejs/kit@2.49.4","@sveltejs/kit@2.49.3","@sveltejs/adapter-vercel@6.3.0","@sveltejs/kit@2.49.2","@sveltejs/kit@2.49.1","@sveltejs/package@2.5.7","@sveltejs/enhanced-img@0.9.2","@sveltejs/adapter-vercel@6.2.0","@sveltejs/enhanced-img@0.9.1","@sveltejs/kit@2.49.0","@sveltejs/kit@2.48.8","@sveltejs/enhanced-img@0.9.0","@sveltejs/package@2.5.6","@sveltejs/kit@2.48.7","@sveltejs/adapter-vercel@6.1.2","@sveltejs/package@2.5.5","@sveltejs/kit@2.48.6","@sveltejs/kit@2.48.5","@sveltejs/enhanced-img@0.8.5","@sveltejs/kit@2.48.4","@sveltejs/kit@2.48.3","@sveltejs/adapter-vercel@6.1.1","@sveltejs/kit@2.48.2","@sveltejs/kit@2.48.1","@sveltejs/adapter-vercel@6.1.0","@sveltejs/kit@2.48.0","@sveltejs/kit@2.47.3","@sveltejs/kit@2.47.2","@sveltejs/kit@2.47.1","@sveltejs/adapter-auto@7.0.0","@sveltejs/kit@2.47.0","@sveltejs/adapter-vercel@6.0.0","@sveltejs/adapter-node@5.4.0","@sveltejs/kit@2.46.5","@sveltejs/kit@2.46.4","@sveltejs/kit@2.46.3","@sveltejs/kit@2.46.2","@sveltejs/kit@2.46.1","@sveltejs/kit@2.46.0","@sveltejs/kit@2.45.0","@sveltejs/kit@2.44.0","@sveltejs/enhanced-img@0.8.4","@sveltejs/kit@2.43.8","@sveltejs/enhanced-img@0.8.3","@sveltejs/adapter-vercel@5.10.3","@sveltejs/adapter-static@3.0.10","@sveltejs/adapter-node@5.3.3","@sveltejs/adapter-netlify@5.2.4","@sveltejs/adapter-cloudflare@7.2.4","@sveltejs/adapter-auto@6.1.1","@sveltejs/kit@2.43.7","@sveltejs/kit@2.43.6","@sveltejs/kit@2.43.5","@sveltejs/kit@2.43.4","@sveltejs/kit@2.43.3","@sveltejs/enhanced-img@0.8.2","@sveltejs/package@2.5.4","@sveltejs/kit@2.43.2","@sveltejs/kit@2.43.1","@sveltejs/kit@2.43.0","@sveltejs/package@2.5.3","@sveltejs/kit@2.42.2","@sveltejs/kit@2.42.1","@sveltejs/kit@2.42.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128120.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}