Description
Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service.
Only applications using both experimental.remoteFunctions and form are vulnerable.
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.49.0, <= 2.52.1
- Patched version(s): 2.52.2
References
Could your website be exposed too?
SmartScanner can check your website for CPU exhaustion in SvelteKit remote form deserialization (experimental only) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Memory exhaustion in SvelteKit remote form deserialization (experimental only) - Vulnerability
- SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimenta - Vulnerability
- SvelteKit: Big remote form function payloads can cause Node process to crash - Vulnerability
- SvelteKit: Prototype pollution in file input deletion path in remote-function forms - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated February 19, 2026