CVE-2026-82259

Name of the Vulnerable Software and Affected Versions SvelteKit versions 2.49.0 through 2.53.2

Description A deserialization expansion issue exists in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form() function to process the files array without validating files.length or individual file sizes, an attacker can submit small inputs that expand into very large file arrays. This results in expensive processing and a denial of service.

Recommendations Update SvelteKit to version 2.53.3. As a temporary mitigation, validate files.length and individual file sizes when using the form() function, or disable the experimental.remoteFunctions feature.