A critical CPU exhaustion vulnerability in SvelteKit allows unauthenticated attackers to trigger a denial of service condition by sending malformed form data.

This is an uncontrolled resource consumption flaw (CWE-400) occurring within the form deserialization process of SvelteKit when experimental remote functions and forms are enabled. An unauthenticated attacker can exploit this by submitting specifically crafted malformed form data, which forces the server to consume excessive CPU resources and become unresponsive.

The vulnerability carries a CVSS score of 7.5, classifying it as a High severity issue due to the ease of exploitation over the network. Successful exploitation results in a denial of service, which can cause significant operational disruption, loss of service availability for end users, and potential degradation of infrastructure performance.

Immediate Action: Update SvelteKit to version 2.52.2 or later to apply the necessary deserialization security patches.

Proactive Monitoring: Monitor server CPU utilization metrics and application error logs for sudden spikes or recurring process hangs indicative of resource exhaustion attacks.

Compensating Controls: If immediate patching is not feasible, consider disabling experimental remote functions and forms, or implement rate limiting at the Web Application Firewall (WAF) layer to block malformed or oversized form submission requests.

Public Exploit Available: Unknown

Given the high impact on service availability and the ease of network-based exploitation, organizations utilizing SvelteKit with experimental features enabled must prioritize this update. Applying the patch to version 2.52.2 is the only definitive method to remediate this vulnerability and ensure continued system stability.