sveltejs/kit · error
Invalid field name ${path}: field names are written in JS ob
Error message
Invalid field name ${path}: field names are written in JS object notation, so keys that would need quoting are not supported. See https://svelte.dev/docs/kit/remote-functions#form-Fields What it means
Form field names are used as paths into the submitted data object and are interpreted as JS object notation (dot/bracket paths like a.b[0].c). Keys that would need quoting (spaces, dashes, special characters) cannot be represented, so split_path rejects them; in dev the message includes the docs link.
Source
Thrown at packages/kit/src/runtime/form-utils.js:478
yield chunk;
}
if (cursor < size) throw new Error('incomplete file data');
})()
);
}
async text() {
return text_decoder.decode(await this.arrayBuffer());
}
}
const path_regex = /^[a-zA-Z_$]\w*(\.[a-zA-Z_$]\w*|\[\d+\])*$/;
/**
* @param {string} path
*/
export function split_path(path) {
if (!path_regex.test(path)) {
throw new Error(
`Invalid field name ${path}` +
(DEV
? ': field names are written in JS object notation, so keys that would need quoting are not supported. See https://svelte.dev/docs/kit/remote-functions#form-Fields'
: '')
);
}
return path.split(/\.|\[|\]/).filter(Boolean);
}
/**
* Check if a property key is dangerous and could lead to prototype pollution
* @param {string} key
*/
function check_prototype_pollution(key) {
if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
throw new Error(
`Invalid key "${key}"` +View on GitHub (pinned to 03f1687fe6)
Solutions
- Rename the field to a valid identifier path (letters, digits, underscores, dots, numeric indices).
- Map external names (e.g. 'my-field') to valid field names and translate them server-side after parsing.
- Sanitize generated names (slugify + identifier-safe transform) before passing them to form.fields.as.
Example fix
// before
fields.as('shipping-address');
// after
fields.as('shippingAddress'); Defensive patterns
Strategy: validation
Validate before calling
const PATH_RE = /^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*|\[\d+\])*$/;
if (!PATH_RE.test(name)) throw new Error(`field name must be valid JS object notation: ${name}`); Prevention
- Use identifier-safe camelCase names for all form fields.
- Slugify/sanitize any name derived from user-visible labels or DB columns.
- Map external names to safe field names server-side after parsing.
When it happens
Trigger: Creating a field whose name contains characters outside the allowed path grammar, e.g. form.fields.as('my-field'), 'user name', or keys starting with digits/brackets that fail path_regex.
Common situations: Using database column names with dashes/spaces as field names; names with non-ASCII characters; auto-generating names from arbitrary labels.
Related errors
- Invalid environment variable name ${JSON.stringify(name)}
- use:enhance can only be used on <form> fields with method="P
- Invalid array key ${keys[i + 1]}
- Could not deserialize binary form: invalid file offset table
- Could not deserialize binary form: invalid file metadata
AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02).
Data as JSON: /api/errors/6c6e87d08bdeb72e.
Report an issue: GitHub.