Kit

CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers to render affected servers unresponsive by submitting malformed form data, resulting in denial of service. Versions 2.49.0 through 2.52.1 of @sveltejs/kit are affected, but only when both the experimental.remoteFunctions and form features are simultaneously enabled - a non-default, opt-in configuration. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects the complete availability impact against network-reachable endpoints with no authentication barrier once the experimental features are active.

Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the server process by sending malformed form data to a remote function endpoint, resulting in complete denial of service. Exploitation is gated behind two simultaneous non-default opt-in conditions - the experimental.remoteFunctions flag and form usage - which significantly narrows the real-world attack surface relative to the CVSS 4.0 score of 8.7. No public exploit or CISA KEV listing has been identified; a vendor-released patch is available in version 2.52.2.

Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who submit crafted multipart form requests that exploit a deserialization expansion flaw in the experimental `form` remote function, causing the server to construct disproportionately large `files` arrays and exhaust processing resources. Exploitation is gated behind a non-default opt-in flag (`experimental.remoteFunctions: true`) and requires the application to process the `files` array without length or size validation, substantially narrowing real-world exposure despite the CVSS 4.0 score of 8.7. No public exploit has been identified at time of analysis and the vulnerability does not appear in the CISA KEV catalog.

Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition in the query.batch() API that can cause concurrent HTTP requests from different authenticated users to merge under a single shared request context. Successful exploitation allows one user to receive response data belonging to another user's simultaneous session, including potentially sensitive application state. Vendor-released patch version 2.60.1 is available; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.

Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from JavaScript object prototypes by supplying crafted, user-controlled file input path names. Affected versions are all @sveltejs/kit releases up to and including 2.69.0; the vendor released a fix in 2.69.1. No active exploitation is documented in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is network-reachable and requires no authentication from the attacker.

Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers to crash the underlying Node.js process by submitting oversized POST payloads. All @sveltejs/kit versions prior to 2.69.1 are affected; no authentication or special configuration is required to trigger the crash. Repeated exploitation can sustain denial-of-service against the application process; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a specially crafted Accept header, triggering quadratic backtracking in the framework's content negotiation regex and causing excessive CPU consumption. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier remote exploitation against default SvelteKit deployments, though real-world impact is partly mitigated where platform-level header length limits are in place. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.

SvelteKit versions prior to 2.57.1 are vulnerable to denial of service when the redirect() function is called from the handle server hook with HTTP header-invalid characters in the location parameter. An unauthenticated remote attacker can trigger an unhandled TypeError by supplying unsanitized user input to the redirect location, potentially causing application crashes on certain platforms. The vulnerability is fixed in version 2.57.1.

Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads, causing denial of service through resource exhaustion. Affects SvelteKit versions prior to 2.57.1 running adapter-node. Exploitation requires specific timing conditions (CVSS AT:P). Platform-level and WAF body size limits remain effective. No public exploit identified at time of analysis. Vulnerability exploits CWE-770 resource allocation flaw where BODY_SIZE_LIMIT enforcement fails under race conditions or specific request patterns.

SvelteKit versions 2.49.0 through 2.49.4 are vulnerable to denial-of-service attacks through the experimental form remote function, which fails to properly validate binary-encoded form payloads and can be exploited to exhaust server memory. An unauthenticated remote attacker can craft a malicious payload to trigger excessive memory allocation, rendering affected applications unavailable. The vulnerability is resolved in version 2.49.5.

SvelteKit 2.19.0-2.49.4 has SSRF/DoS affecting applications with prerendered routes. Can be exploited to make the server perform arbitrary requests or become unresponsive. Patch available.

SvelteKit is a web development kit. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.