---
id: CVE-2026-82259
title: >-
  SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a
  deserialization expansion issue in the experimental form remote function
summary: >-
  SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a
  deserialization expansion issue in the experimental form remote function. When
  an application enables experimental.remoteFunctions and uses the form function
  to pr…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-502
vendor: svelte
product: sveltekit
affected:
  - 'sveltekit >= 2.49.0, < 2.53.3'
patched:
  - sveltekit 2.53.3
published: '2026-08-28'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:48.623'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82259'
references:
  - url: 'https://github.com/sveltejs/kit/security/advisories/GHSA-fpg4-jhqr-589c'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/sveltekit-2.49.0-before-2.53.3-denial-of-service-via-form
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-28T13:51:36.293052Z'
epss: 0.00533
epssPercentile: 0.43191
ingestedAt: '2026-10-08T16:52:14.734Z'
---

## Overview

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.

## Affected

- `sveltekit >= 2.49.0, < 2.53.3`

## Remediation

Upgrade past the affected range:

- `sveltekit 2.53.3`