SvelteKit’s experimental form remote function, used from versions 2.49.0 through 2.49.4, deserializes binary data that represents submitted form data. A specially crafted payload can trigger the server to allocate a large volume of memory, leading to a denial‑of‑service through memory exhaustion. The weakness corresponds to uncontrolled or arbitrary resource consumption (CWE‑770) and inappropriate input handling (CWE‑789).

Vulnerable releases of the SvelteKit framework, specifically versions 2.49.0, 2.49.1, 2.49.2, 2.49.3, and 2.49.4, built with Node.js and used in web applications by developers specifying adapter-node. No other product versions are mentioned as affected.

The vulnerability receives a CVSS score of 8.2, indicating high severity. The EPSS score is below 1 %, suggesting a low but nonzero probability of exploitation at present, and it is not listed in CISA’s KEV catalog. The attack vector is inferred to be a network‑bound HTTP request to a remote function endpoint, which accepts a binary payload, enabling an attacker to trigger memory exhaustion from a remote location.