SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.

SvelteKit versions 2.49.0 through 2.53.2 contain a deserialization expansion vulnerability in the experimental form remote function. When applications enable experimental.remoteFunctions and use the form function to process file arrays without proper validation, attackers can submit small inputs that expand into very large file arrays. This leads to expensive server-side processing and denial of service conditions. The vulnerability is fixed in SvelteKit version 2.53.3. Affected applications must have the experimental.remoteFunctions feature enabled to be vulnerable. The issue stems from missing validation of files.length and individual file sizes in the form function handler.