Packages / @sveltejs/kit / Security
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)
Affected releases · @sveltejs/kit
- 2.x2.49.0 – 2.53.2Fixed in 2.53.3
On 2.x, the newest line:
npm install @sveltejs/kit@2.53.3Not affected
3.0.0 – 3.1.0
3 releases, latest
Not affected
2.0.0 – 2.48.8
189 releases
Affected
2.49.0 – 2.53.2
15 releases
Fixed
2.53.3 – 2.70.3
33 releases
Is your project affected?
Paste your package.json, or type the range you declare for @sveltejs/kit. It is read in your browser and sent nowhere.
What happens
Some relatively small inputs can cause very large files arrays in form handlers. If the SvelteKit application code doesn't check files.length or individual files' sizes and performs expensive processing with them, it can result in Denial of Service.
Only users with experimental.remoteFunctions: true who are using the form function and are processing the files array without validation are vulnerable.