LOW
GHSA-fpg4-jhqr-589c
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)
Quick fix
GHSA-fpg4-jhqr-589c — @sveltejs/kit: upgrade to the fixed version with the command below.
npm install @sveltejs/kit@2.53.3Details
Some relatively small inputs can cause very large files arrays in `form` handlers. If the SvelteKit application code doesn't check `files.length` or individual files' sizes and performs expensive processing with them, it can result in Denial of Service.
Only users with `experimental.remoteFunctions: true` who are using the `form` function and are processing the `files` array without validation are vulnerable.
Are you affected?
Enter the version of the package you're using.