GitHub Advisoryadvisory · npm

GHSA-fpg4-jhqr-589c SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)

LOW Published 2026-02-28 Modified 2026-02-28 Official page ↗
Ecosystem
npm
Packages
@sveltejs/kit
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-770
Reviewed
2026-02-28

Affected packages

• npm @sveltejs/kit: >= 2.49.0, < 2.53.3 → fixed in 2.53.3

Description

Some relatively small inputs can cause very large files arrays in `form` handlers. If the SvelteKit application code doesn't check `files.length` or individual files' sizes and performs expensive processing with them, it can result in Denial of Service. Only users with `experimental.remoteFunctions: true` who are using the `form` function and are processing the `files` array without validation are vulnerable.

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References