A memory exhaustion vulnerability in SvelteKit allows unauthenticated remote attackers to crash server processes via malformed form deserialization.

This is a resource consumption flaw (CWE-400) where the application fails to safely handle deserialization of remote form data. An unauthenticated attacker can trigger excessive memory allocation, which forces the server process to crash.

The vulnerability carries a CVSS score of 7.5, reflecting its high impact on service availability. A successful exploit results in a denial of service, effectively taking the application offline and causing significant operational disruption, potential loss of revenue, and degradation of user experience for legitimate customers.

Immediate Action: Update the SvelteKit package to version 2.52.2 or later to resolve the deserialization flaw.

Proactive Monitoring: Monitor server memory usage metrics and application logs for repeated process restarts or abnormal memory spikes associated with form submission endpoints.

Compensating Controls: If immediate patching is not feasible, implement request rate limiting or payload size restrictions at the Web Application Firewall layer to mitigate the impact of malformed form data.

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available in the provided data.

The high severity of this vulnerability necessitates prompt attention, as it provides a trivial path for attackers to disrupt service availability. Organizations utilizing SvelteKit with the experimental remote functions feature enabled should prioritize upgrading to version 2.52.2 immediately to eliminate the underlying memory exhaustion risk.