Executive brief
SvelteKit is a web framework for building fast, interactive applications. When the experimental remote functions feature is enabled, small inputs can be expanded into very large file arrays that cause denial of service if an application processes them without validation. This affects only applications that enable the experimental feature and don't validate file sizes.
Technical details
The vulnerability is a deserialization expansion issue (CWE-770) in SvelteKit's experimental `form` remote function. An attacker can craft relatively small inputs that deserialize into very large file arrays. The attack requires network access and only affects applications with `experimental.remoteFunctions: true` enabled and processing file arrays without length or size validation. An attacker can trigger expensive processing on oversized data structures, resulting in denial of service. The issue is fixed in version 2.53.3 by preventing overlapping file metadata during deserialization.
Affected products
- Svelte SvelteKit 2.49.0 to 2.53.2
Timeline
- 2026-02-28: disclosed: Advisory published
- 2026-02-28: patched: Fixed in version 2.53.3