N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-fpg4-jhqr-589c

GHSA-fpg4-jhqr-589c: SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)

Some relatively small inputs can cause very large files arrays in form handlers. If the SvelteKit application code doesn't check files.length or individual files' sizes and performs expensive processing with them, it can result in Denial of Service.

Only users with experimental.remoteFunctions: true who are using the form function and are processing the files array without validation are vulnerable.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-fpg4-jhqr-589c

GHSA-fpg4-jhqr-589c:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@sveltejs/kit	npm	>= 2.49.0, <= 2.53.2	2.53.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the deserialize_binary_form function within packages/kit/src/runtime/form-utils.js. The provided patch faba869db3644077169bf5d7c6e41fd5f3d6c65e clearly shows the addition of logic to prevent a resource amplification attack. The core of the vulnerability is that the function did not check for overlapping file data regions in the binary form payload. An attacker could create a payload with many file entries in the metadata all pointing to the same small piece of data in the request body. When the SvelteKit application processes this, it would instantiate a large number of File objects, consuming significant server resources and leading to a Denial of Service. The patch mitigates this by introducing checks to ensure that file data regions do not overlap and that each file offset table entry is used only once. The new tests added in packages/kit/src/runtime/form-utils.spec.js, specifically 'rejects overlapping file data' and 'rejects amplification attack via overlapping file data', confirm the nature of the vulnerability and the fix. Therefore, deserialize_binary_form is the precise function where the vulnerability exists.

Vulnerable functions

deserialize_binary_form

packages/kit/src/runtime/form-utils.js

The `deserialize_binary_form` function is vulnerable to a resource amplification attack. Before the patch, it did not validate that the byte ranges for files specified in the form's metadata were unique and did not overlap. An attacker could craft a small request where numerous file metadata entries point to the same small block of actual file data. This would cause the application to perceive a massive amount of file data, leading to excessive memory and CPU consumption when processing the `files` array, resulting in a Denial of Service. The vulnerability is in the logic that processes the file metadata without checking for these overlaps.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.