CVE-2026-82259: SvelteKit 2.49.0 before 2.53.3 Denial of Service via form
SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SvelteKitto a version that resolves this vulnerability.Fixed in 2.53.3 - Configuration
If you enable experimental.remoteFunctions, validate files.length and each file’s size before processing the files array with the form function (the vulnerability is triggered when files.length or individual file sizes are not validated).
SvelteKit experimental.remoteFunctions + form experimental.remoteFunctions (and use of form to process files array) = Enable only with server-side validation of files.length and individual file sizes
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service issue?
Applications using SvelteKit versions 2.49.0 through 2.53.2 are exposed only when they enable experimental.remoteFunctions and use the form function to process the files array without validating files.length or individual file sizes.
What does an attacker need to exploit the issue?
An attacker can exploit the issue remotely without authentication or user interaction by submitting relatively small inputs designed to expand into very large file arrays.
How can the issue be mitigated before upgrading?
Validate files.length and the size of each individual file before processing the files array. This limits the expansion-driven processing cost described by the advisory.
What version fixes the vulnerability?
SvelteKit 2.53.3 fixes the issue. Affected versions are 2.49.0 through 2.53.2.