MEDIUM

GHSA-88qp-p4qg-rqm6

CPU exhaustion in SvelteKit remote form deserialization (experimental only)

Quick fix

GHSA-88qp-p4qg-rqm6 — @sveltejs/kit: upgrade to the fixed version with the command below.

npm install @sveltejs/kit@2.52.2

Details

Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service.

Only applications using both `experimental.remoteFunctions` and `form` are vulnerable.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@sveltejs/kit

Introduced in: 2.49.0Fixed in: 2.52.2

Fixnpm install @sveltejs/kit@2.52.2

References

https://github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6[WEB]
https://github.com/sveltejs/kit/commit/3e607b314aec9e5f278d32847945b8b6323e1cb8[WEB]
https://github.com/sveltejs/kit[PACKAGE]
https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2[WEB]