SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.

SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a memory exhaustion vulnerability in remote form deserialization. The flaw is triggered when experimental remote functions (experimental.remoteFunctions) and form handling are enabled. Attackers can send malformed form data to cause excessive memory allocation, crashing the server process and resulting in a denial of service condition. The vulnerability requires no authentication and can be exploited remotely. It affects only configurations using the experimental remoteFunctions feature with forms enabled. The issue has been patched in version 2.52.2. Users are advised to upgrade immediately or disable the experimental.remoteFunctions feature as a workaround. The vulnerability is tracked as CVE-2026-82260 and has an associated GitHub Security Advisory GHSA-vrhm-gvg7-fpcf.