{"id":"GHSA-3r8g-jcqq-3p5j","kind":"vulnerability","aliases":["GHSA-3r8g-jcqq-3p5j"],"related":[],"title":"DoS while parsing form data from a remote functions `form`","description":"This only affects applications using the experimental remote functions flag and utilizing the `form` remote function. A specially-crafted request could block the event loop for extended periods of time during parsing.","summary":"A specially crafted request to a SvelteKit form remote function can make form data parsing block the Node.js event loop for long periods. The result is a denial of service: the app stops responding to other requests while it is stuck.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@sveltejs/kit","fixed":["3.1.1"],"affected":">= 2.42.0, <= 3.1.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-407","node","package","self-hosted","sveltekit"],"not_affected_if":["no-form-remote-function","remote-functions-flag-off","static-export"],"how_to_check":"- Check the installed version with `npm ls @sveltejs/kit`\n- Search the project config for the experimental remote functions flag and for `form` remote functions in your source\n- Only affected if both the flag is on and a `form` remote function is used","fix":"- `@sveltejs/kit` `3.1.1` (affected range `>= 2.42.0`, `<= 3.1.0`)","status":"open","published_at":"2026-10-29T23:47:31+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","triaged_at":"2026-11-09T22:54:24+00:00","updated_at":"2026-11-09T22:54:24+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:54:24Z","model":"claude-haiku-5-5","output":{"fix":"- `@sveltejs/kit` `3.1.1` (affected range `>= 2.42.0`, `<= 3.1.0`)","reach":"internet","title":"SvelteKit: crafted form request can block the server event loop","impact":"low","summary":"A specially crafted request to a SvelteKit form remote function can make form data parsing block the Node.js event loop for long periods. The result is a denial of service: the app stops responding to other requests while it is stuck.","audience":"developers","category":"package","nicknames":[],"who_cares":["sveltekit","node","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Server stops responding while parsing a crafted form request","analyst_note":"product_name","how_to_check":"- Check the installed version with `npm ls @sveltejs/kit`\n- Search the project config for the experimental remote functions flag and for `form` remote functions in your source\n- Only affected if both the flag is on and a `form` remote function is used","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["remote-functions-flag-off","no-form-remote-function","static-export"],"who_is_affected":"Only applications that enable the experimental remote functions flag and use the `form` remote function are exposed. A crafted request to that endpoint can stall the server's event loop during form parsing. Apps that do not enable the flag, or that do not use `form` remote functions, can skip this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4586,"output_tokens":532,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-407':23B '3p5j':15A,20A '3r8g':13A,18A 'affect':73C 'app':61B 'applic':74C 'block':45B,93C 'could':92C 'craft':32B,90C 'cwe':22B 'data':5A,43B 'denial':57B 'dos':1A 'event':48B,95C 'experiment':77C 'extend':98C 'flag':80C 'form':4A,10A,37B,42B,84C 'function':9A,39B,79C,86C 'ghsa':12A,17A 'ghsa-3r8g-jcqq-3p5j':11A,16A 'host':28B 'jcqq':14A,19A 'long':51B 'loop':49B,96C 'make':41B 'node':24B 'node.js':47B 'packag':25B 'pars':3A,44B,103C 'period':52B,99C 'remot':8A,38B,78C,85C 'request':33B,66B,91C 'respond':63B 'result':54B 'self':27B 'self-host':26B 'servic':59B 'special':31B,89C 'specially-craft':88C 'stop':62B 'stuck':70B 'sveltejs/kit':21A 'sveltekit':29B,36B 'time':101C 'use':75C 'util':82C","nicknames":[],"mitigations":[],"who_affected":"Only applications that enable the experimental remote functions flag and use the `form` remote function are exposed. A crafted request to that endpoint can stall the server's event loop during form parsing. Apps that do not enable the flag, or that do not use `form` remote functions, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["kit"],"ptokens":["kit","sveltejs"],"labels":["cwe407","high","node","npm","package","selfhosted","sveltekit"],"campaign_type":null,"search_a":"'3p5j':15A,20A '3r8g':13A,18A 'data':5A 'dos':1A 'form':4A,10A 'function':9A 'ghsa':12A,17A 'ghsa-3r8g-jcqq-3p5j':11A,16A 'jcqq':14A,19A 'pars':3A 'remot':8A 'sveltejs/kit':21A","search_b":"'-407':23B 'app':61B 'block':45B 'craft':32B 'cwe':22B 'data':43B 'denial':57B 'event':48B 'form':37B,42B 'function':39B 'host':28B 'long':51B 'loop':49B 'make':41B 'node':24B 'node.js':47B 'packag':25B 'pars':44B 'period':52B 'remot':38B 'request':33B,66B 'respond':63B 'result':54B 'self':27B 'self-host':26B 'servic':59B 'special':31B 'stop':62B 'stuck':70B 'sveltekit':29B,36B","search_c":"'affect':73C 'applic':74C 'block':93C 'could':92C 'craft':90C 'event':95C 'experiment':77C 'extend':98C 'flag':80C 'form':84C 'function':79C,86C 'loop':96C 'pars':103C 'period':99C 'remot':78C,85C 'request':91C 'special':89C 'specially-craft':88C 'time':101C 'use':75C 'util':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T23:47:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-3r8g-jcqq-3p5j","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-3r8g-jcqq-3p5j","severity":"high","published_at":"2026-10-29T23:47:31+00:00","modified_at":"2026-10-29T23:47:32+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","fetched_at":"2026-11-09T22:53:15+00:00","note":null}],"documents":[{"id":110419,"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-3r8g-jcqq-3p5j","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}