SvelteKit versions 2.49.0 through 2.53.2 contain a deserialization expansion vulnerability in the experimental form remote function. When applications enable experimental.remoteFunctions and use the form function to process file arrays without proper validation, attackers can exploit this flaw by submitting small inputs that expand into very large file arrays. This leads to excessive processing overhead and potential denial of service conditions. The vulnerability specifically affects the files.length and individual file size validation logic. A fix has been released in SvelteKit version 2.53.3. The issue is classified as a deserialization expansion or 'zip bomb'-style attack vector targeting file upload handling. Developers using the experimental remote functions feature should upgrade immediately to mitigate risk.