MEDIUM

GHSA-vrhm-gvg7-fpcf

Memory exhaustion in SvelteKit remote form deserialization (experimental only)

Quick fix

GHSA-vrhm-gvg7-fpcf — @sveltejs/kit: upgrade to the fixed version with the command below.

npm install @sveltejs/kit@2.52.2

Details

Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.

Only applications using both `experimental.remoteFunctions` and `form` are vulnerable.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@sveltejs/kit

Introduced in: 2.49.0Fixed in: 2.52.2

Fixnpm install @sveltejs/kit@2.52.2

References

https://github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcf[WEB]
https://github.com/sveltejs/kit/commit/f47c01bd8100328c24fdb8522fe35913b0735f35[WEB]
https://github.com/sveltejs/kit[PACKAGE]
https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2[WEB]