@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve

Description

The experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion.

Recommendation

Update the @sveltejs/kit package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.49.0, <= 2.49.4
• Patched version(s): 2.49.5

References

• GHSA-j2f3-wq62-6q46
• CVE-2026-22803
• CWE-789
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Memory exhaustion in SvelteKit remote form deserialization (experimental only) - Vulnerability
• LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern - CVE-2026-33287
• axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
• @sveltejs/kit has unescaped error message included on error page - CVE-2024-53262

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

Exploiting Server Version Disclosure

Tags:

npm

@sveltejs/kit