N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-vrhm-gvg7-fpcf

GHSA-vrhm-gvg7-fpcf: Memory exhaustion in SvelteKit remote form deserialization (experimental only)

Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.

Only applications using both experimental.remoteFunctions and form are vulnerable.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-vrhm-gvg7-fpcf

GHSA-vrhm-gvg7-fpcf:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@sveltejs/kit	npm	>= 2.49.0, <= 2.52.1	2.52.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the deserialize_binary_form function located in packages/kit/src/runtime/form-utils.js. The function is responsible for deserializing binary form data from a request. The security advisory mentions that malformed form data can lead to memory exhaustion. The provided commit patch f47c01bd8100328c24fdb8522fe35913b0735f35 confirms this. Before the patch, the code directly parsed a section of the request representing file offsets using JSON.parse and assumed it would be a flat array of numbers. However, no validation was performed on the parsed structure. The patch introduces strict validation to ensure the parsed data is an array of non-negative integers. The added test case demonstrates an attack where a nested array in the file offsets table, when processed, would lead to type coercion and a very large string allocation, causing the process to crash. Therefore, the deserialize_binary_form function is the vulnerable function as it's the entry point for processing the malicious data.

Vulnerable functions

deserialize_binary_form

packages/kit/src/runtime/form-utils.js

The function `deserialize_binary_form` is vulnerable to memory exhaustion. It parses a `file_offsets` table from the request body using `JSON.parse` without proper validation. An attacker can craft a malicious payload where `file_offsets` is a nested array. When this nested array is later used in operations that cause type coercion to a string, it can lead to a massive string allocation, consuming excessive memory and causing a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.