Description

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T12:16:39.100Z",
  "pubdate": "2026-08-28T12:16:39.100Z",
  "executiveSummary": "SvelteKit versions 2.49.0 through 2.52.1 are susceptible to a memory exhaustion vulnerability specifically within the experimental.remoteFunctions feature when handling form data submissions.\nThe vulnerability arises from improper handling of malformed form data during the deserialization process, which triggers uncontrolled memory allocation.\nAn unauthenticated remote attacker can exploit this flaw by sending specially crafted form payloads to a SvelteKit application where remote functions are enabled.\nSuccessful exploitation results in a Denial of Service (DoS) due to the exhaustion of available system memory, leading to an immediate crash of the server process.\nThe vulnerability represents a critical availability risk for any web application utilizing the experimental remote functions functionality.\nThis issue is resolved in version 2.52.2, which introduces stricter input validation and memory management during the deserialization of remote function form submissions.",
  "technicalDetails": "The vulnerability resides in the deserialization logic of the experimental.remoteFunctions feature within @sveltejs/kit. The root cause is an insecure handling mechanism that fails to enforce constraints on incoming serialized form data before memory is allocated for object reconstruction.\nWhen a form submission is processed by a remote function, the framework attempts to map the serialized input data back into structured JavaScript objects. If an attacker submits a malformed payload containing deeply nested structures, circular references, or extremely large input buffers that defy standard deserialization limits, the memory allocation routine fails to bound the consumption.\nThe attack flow begins with the attacker identifying an endpoint that utilizes experimental.remoteFunctions. The attacker then intercepts or constructs an HTTP POST request containing a malicious form payload. Upon reaching the server, the SvelteKit deserializer attempts to parse this data. Due to the lack of input sanitization or size-limiting logic at the deserialization stage, the Node.js process attempts to allocate memory proportional to the expanded representation of the malicious payload.\nThis leads to a rapid increase in Resident Set Size (RSS) memory consumption, effectively exhausting the server heap. Once the system memory is depleted or the Node.js garbage collector becomes overwhelmed, the server process enters a failed state and crashes. This cycle can be repeated to maintain a sustained denial of service.\nThe vulnerability is present in versions >=2.49.0 and <=2.52.1. Exploitation is facilitated via standard network exposure, and as this functionality is intended for public-facing forms, it does not require prior authentication or elevated privileges. The payload behavior is strictly focused on resource depletion rather than code execution or privilege escalation; however, the impact is a total loss of application availability. The issue is mitigated in 2.52.2, which implements hardened deserialization routines that properly handle and reject malformed inputs before resource exhaustion occurs."
}