The flaw is a deserialization expansion vulnerability in SvelteKit's experimental remote form handler. When the experimental.remoteFunctions feature is enabled, the framework accepts a files array from form submissions without checking its length or the size of each entry. An attacker can craft a small payload that expands into a very large array during processing, consuming excessive memory and CPU and ultimately causing a denial of service. The weakness is identified as CWE-502.

The vulnerability affects the SvelteKit web framework supplied by sveltejs. Versions from 2.49.0 through 2.53.2 are impacted; patch 2.53.3 and later include the fix.

The issue scores a CVSS of 8.7, indicating a high‑severity denial‑of‑service condition. The EPSS score is not publicly available, but the flaw can be triggered via normal web traffic, so the attack vector is remote. Because the problem resides in an experimental feature, the likelihood of exploitation depends on how many deployments have enabled experimental.remoteFunctions. The vulnerability is not listed in the CISA KEV catalog.