CVE-2026-82259

CVE-2026-82259 is a deserialization expansion flaw (CWE-502) in the experimental form remote function of SvelteKit, affecting versions 2.49.0 through 2.53.2 and fixed in 2.53.3. It is triggered when an application enables experimental.remoteFunctions and a form remote function processes the incoming files array without validating files.length or individual file sizes, allowing small attacker-supplied inputs to deserialize into very large in-memory file arrays. An unauthenticated, network-reachable attacker can exploit this to force expensive processing and cause denial of service; the CVSS 4.0 score of 8.7 (high) reflects availability-only impact with no confidentiality or integrity loss. Only SvelteKit applications on the affected versions that opted into the experimental remote functions feature and handle file uploads through form remotes are exposed; no other products are listed. There is no public proof of concept, no CISA KEV listing, and no known exploitation to date, with EPSS estimating a 0.4% probability of exploitation in the next 30 days (30th percentile).

What to do: Upgrade to SvelteKit 2.53.3 or later. Until upgraded, in any form remote function validate files.length and enforce per-file size limits before processing, or disable experimental.remoteFunctions if the feature is not required. Also confirm whether your application enables experimental.remoteFunctions at all, since without it this flaw is not reachable.