@SVELTEJS/KIT · GHSA-3r8g-jcqq-3p5j · Package
FIX → 3.1.1
A specially crafted request to a SvelteKit form remote function can make form data parsing block the Node.js event loop for long periods. The result is a denial of service: the app stops responding to other requests while it is stuck.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications that enable the experimental remote functions flag and use the form remote function are exposed. A crafted request to that endpoint can stall the server's event loop during form parsing. Apps that do not enable the flag, or that do not use form remote functions, can skip this.
Not affected if no-form-remote-function, remote-functions-flag-off, static-export
Who cares node, self-hosted, sveltekit
npm ls @sveltejs/kitform remote functions in your sourceform remote function is usedUpgrade to 3.1.1
This only affects applications using the experimental remote functions flag and utilizing the form remote function. A specially-crafted request could block the event loop for extended periods of time during parsing.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
@sveltejs/kit 3.1.1 (affected range >= 2.42.0, <= 3.1.0)