SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.

SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a memory exhaustion vulnerability in remote form deserialization. The vulnerability is triggered when the experimental.remoteFunctions feature with form support is enabled. Malformed form data submitted by attackers can cause excessive memory allocation on the server. This leads to the server process crashing and results in a denial of service condition. The vulnerability is specifically tied to the experimental remote functions feature. No authentication appears to be required to exploit this vulnerability, making it accessible to unauthenticated attackers. The issue has been patched in version 2.52.2 of SvelteKit. Users running affected versions with the experimental remote functions and form features enabled should upgrade immediately. The vulnerability is tracked as CVE-2026-82260 and has an associated GitHub Security Advisory GHSA-vrhm-gvg7-fpcf.