Description
The experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion.
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.49.0, <= 2.49.4
- Patched version(s): 2.49.5
References
Could your website be exposed too?
SmartScanner can check your website for @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Memory exhaustion in SvelteKit remote form deserialization (experimental only) - Vulnerability
- LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern - CVE-2026-33287
- axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
- @sveltejs/kit has unescaped error message included on error page - CVE-2024-53262
You might also like:
See something that needs correcting? Let us knowUpdated January 15, 2026