SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.

SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a memory exhaustion vulnerability in remote form deserialization. The flaw is triggered when the experimental.remoteFunctions feature is enabled along with form support. Malformed form data can cause excessive memory allocation, ultimately crashing the server process and resulting in denial of service. The vulnerability is exploitable remotely by sending specially crafted malformed form data to the affected server. No authentication appears to be required to trigger the issue. The vulnerability has been fixed in SvelteKit version 2.52.2. Users are advised to upgrade immediately. A GitHub Security Advisory (GHSA-vrhm-gvg7-fpcf) and VulnCheck advisory have been published alongside the NVD entry.