CVE-2026-82259: Deserialization of Untrusted Data in sveltejs kit

CVE-2026-82259 describes a deserialization expansion vulnerability in SvelteKit's experimental.remoteFunctions feature affecting versions from 2.49.0 up to but not including 2.53.3. When enabled, the form function can process the files array without validating files.length or individual file sizes. An attacker can exploit this by submitting small inputs that expand into very large file arrays, causing excessive resource consumption and denial of service conditions. This vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. The issue is resolved in SvelteKit version 2.53.3.

Successful exploitation allows an unauthenticated attacker to cause denial of service by triggering expensive processing through crafted inputs that expand into large file arrays. This can degrade or disrupt service availability. There is no indication of code execution or data disclosure from the provided information.

Upgrade SvelteKit to version 2.53.3 or later to apply the official fix. Until upgraded, avoid enabling experimental.remoteFunctions or ensure strict validation of files.length and individual file sizes in the form function to prevent deserialization expansion attacks.