SvelteKit versions 2.49.0 through 2.52.1 expose a memory exhaustion flaw when experimental remote functions are enabled and forms are processed. Malformed form data can trigger abnormal memory allocation during deserialization, leading the server to consume excessive resources and crash. The primary consequence is a denial of service, disrupting application availability.

The vulnerability affects the SvelteKit framework (sveltejs:kit) for each release between 2.49.0 and 2.52.1 inclusive. It is relevant only when the experimental.remoteFunctions feature is active and form handling is enabled. Users on these versions that accept remote form submissions are directly impacted.

The CVSS score of 8.7 indicates a high severity level. EPSS data is not available, but the absence of a KEV listing suggests the vulnerability has not yet been widely exploited. The likely attack vector involves an attacker submitting specially crafted form data to a server endpoint that processes remote forms. If successful, the server will large‑allocate memory, exhausting resources and causing a crash. Immediate patching or disabling the vulnerable feature mitigates the risk.