GitHub Advisoryadvisory · npm

GHSA-vrhm-gvg7-fpcf Memory exhaustion in SvelteKit remote form deserialization (experimental only)

MEDIUM Published 2026-02-19 Modified 2026-02-19 Official page ↗
Ecosystem
npm
Packages
@sveltejs/kit
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-770
Reviewed
2026-02-19

Affected packages

• npm @sveltejs/kit: >= 2.49.0, < 2.52.2 → fixed in 2.52.2

Description

Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service. Only applications using both `experimental.remoteFunctions` and `form` are vulnerable.

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References