SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.

SvelteKit versions 2.49.0 through 2.53.2 contain a deserialization expansion vulnerability in the experimental form remote function. When applications enable experimental.remoteFunctions and use the form function to process file arrays without proper validation, attackers can exploit this flaw by submitting small inputs that expand into very large file arrays. This leads to excessive processing overhead and potential denial of service conditions. The vulnerability specifically affects the files.length and individual file size validation logic. A fix has been released in SvelteKit version 2.53.3. The issue is classified as a deserialization expansion or 'zip bomb'-style attack vector targeting file upload handling. Developers using the experimental remote functions feature should upgrade immediately to mitigate risk.