CyberRota Analysis
AI-GeneratedSvelteKit versions 2.49.0 through 2.53.2 are vulnerable due to a deserialization expansion issue in the experimental form remote function, which can be exploited when the files array is processed without proper validation of its length or individual file sizes. This vulnerability allows attackers to submit small inputs that expand into large file arrays, potentially causing significant processing overhead and resulting in denial of service. Developers and organizations using affected SvelteKit versions should prioritize updating to version 2.53.3 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.
Related CVEs
Other vulnerabilities affecting the same vendor(s)