SvelteKit: Big remote form function payloads can cause Node process to crash

Description

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.

Recommendation

Update the @sveltejs/kit package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.69.0
• Patched version(s): 2.69.1

References

• GHSA-wqjv-9729-c5q2
• CWE-248

Related Issues

• SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimenta - Vulnerability
• SvelteKit: Prototype pollution in file input deletion path in remote-function forms - Vulnerability
• CPU exhaustion in SvelteKit remote form deserialization (experimental only) - Vulnerability
• Memory exhaustion in SvelteKit remote form deserialization (experimental only) - Vulnerability

You might also like:

5 Security Vulnerabilities You Can Fix Right Now

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@sveltejs/kit