Description
The experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion.
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.49.0, <= 2.49.4
- Patched version(s): 2.49.5
References
Could your website be exposed too?
SmartScanner can check your website for @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @sveltejs/kit has unescaped error message included on error page - CVE-2024-53262
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
- Memory exhaustion in SvelteKit remote form deserialization (experimental only) - Vulnerability
- protobufjs: Memory amplification from preserved unknown fields in binary decode - CVE-2026-54270
You might also like:
See something that needs correcting? Let us knowUpdated January 15, 2026