Description
Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.
Only applications using both experimental.remoteFunctions and form are vulnerable.
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.49.0, <= 2.52.1
- Patched version(s): 2.52.2
References
Could your website be exposed too?
SmartScanner can check your website for Memory exhaustion in SvelteKit remote form deserialization (experimental only) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CPU exhaustion in SvelteKit remote form deserialization (experimental only) - Vulnerability
- SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimenta - Vulnerability
- SvelteKit: Big remote form function payloads can cause Node process to crash - Vulnerability
- @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve - CVE-2026-22803
You might also like:
See something that needs correcting? Let us knowUpdated February 19, 2026