SvelteKit versions prior to 2.69.1 do not enforce size limits on payloads sent to the remote form function, representing a CWE-400 Resource Exhaustion weakness. Attackers can exploit this by submitting large payloads, causing the underlying Node.js process to crash. Each crash terminates the application, leading to a denial of service.

The vulnerability affects the SvelteKit framework distributed by sveltejs:kit. All installations built with versions before 2.69.1 are vulnerable. The affected product is the SvelteKit runtime for Node.js applications.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Attackers can remotely trigger the payload overflow by POSTing a large form to any publicly exposed SvelteKit endpoint. The effort required is low because the code path is exposed over the network, and no special credentials are needed. Successful exploitation causes the Node process to crash, resulting in an outage that can be repeated until the service recovers.