Description

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T12:16:39.250Z",
  "pubdate": "2026-08-28T12:16:39.250Z",
  "executiveSummary": "SvelteKit versions 2.49.0 through 2.52.1 are susceptible to a CPU exhaustion vulnerability stemming from improper handling of form deserialization when experimental remote functions and form features are enabled.\nThis vulnerability allows an unauthenticated remote attacker to trigger a denial-of-service (DoS) condition by submitting specifically crafted, malformed form data.\nThe flaw lies in the server-side processing logic, where the deserialization routine fails to adequately constrain resource consumption, leading to excessive CPU cycles during the parsing of malicious payloads.\nThe primary impact is the complete loss of availability for the SvelteKit application, as the event loop or worker threads become blocked by the compute-intensive deserialization process.\nSuccessful exploitation requires no prior authentication, as the vulnerable endpoint is accessible via standard HTTP form submission channels.\nOrganizations utilizing affected versions of @sveltejs/kit with the specified experimental features active are at immediate risk of service disruption and should prioritize remediation to restore application stability.",
  "technicalDetails": "The vulnerability resides within the deserialization logic responsible for processing incoming form data when experimental remote functions and form capabilities are enabled in @sveltejs/kit.\nThe root cause is an algorithmic complexity issue during the parsing phase. When the SvelteKit server receives a specially crafted payload, the deserializer enters an inefficient processing state that consumes disproportionate CPU resources.\nThe attack flow initiates when an attacker sends a crafted HTTP POST request containing a malformed form-encoded payload to a target SvelteKit endpoint. Because the experimental form handling mechanism fails to implement necessary validation or resource limits on the incoming data structure, the deserialization routine attempts to process the payload in a way that triggers extreme CPU utilization.\nThis behavior results in a thread-blocking scenario. In environments like Node.js, where the main event loop is often shared, this saturation prevents the server from responding to legitimate traffic, effectively rendering the application unresponsive.\nThe vulnerability does not require any specific user privileges, as it is exploitable at the network layer through public-facing endpoints. The payload behaves as a resource exhaustion vector; there is no evidence of arbitrary code execution or memory corruption in this specific context. The impact is strictly limited to application-level availability.\nVersion scope is strictly defined between @sveltejs/kit 2.49.0 and 2.52.1. The implementation of the deserialization logic in these versions lacks the heuristic checks required to identify and discard or throttle malformed inputs before they consume significant compute cycles.\nThe exploit is repeatable and deterministic, as the server will repeatedly attempt to parse the provided structure, leading to a consistent hang or crash depending on the server's timeout configuration and resource constraints."
}