SvelteKit versions from 2.49.0 through 2.52.1 that enable experimental remote functions and form processing are vulnerable to CPU exhaustion when the server deserializes maliciously crafted form data. This is a resource exhaustion flaw (CWE-400). The flaw allows an attacker to send specially constructed payloads that force the server to perform excessive computation, driving the server into a long‑running or blocking state and rendering it unresponsive to legitimate traffic. The primary consequence is a denial of service to the application’s users and potentially to downstream services that rely on the same host.

Any deployment of SvelteKit 2.49.0 up to and including 2.52.1 that has experimental remote functions and form support enabled is affected. The vulnerability exists regardless of the hosting environment or operating system, and applies to all deployments of SvelteKit 2.49.0–2.52.1 with experimental remote functions and form processing enabled.

The CVSS score of 8.7 indicates high severity, and although no Exploit Probability (EPSS) data is available, the lack of a KEV listing does not negate the risk of exploitation. The attack vector is inferred to be remote via HTTP requests to any route that accepts form data, requiring only the ability to deliver malformed form submissions. An attacker could repeatedly flood the target with such requests, causing resource exhaustion and a sustained denial of service.