sveltejs/kit · error

Invalid field name ${path}: field names are written in JS ob

Error message

Invalid field name ${path}: field names are written in JS object notation, so keys that would need quoting are not supported. See https://svelte.dev/docs/kit/remote-functions#form-Fields

What it means

Form field names are used as paths into the submitted data object and are interpreted as JS object notation (dot/bracket paths like a.b[0].c). Keys that would need quoting (spaces, dashes, special characters) cannot be represented, so split_path rejects them; in dev the message includes the docs link.

Source

Thrown at packages/kit/src/runtime/form-utils.js:478

					yield chunk;
				}
				if (cursor < size) throw new Error('incomplete file data');
			})()
		);
	}
	async text() {
		return text_decoder.decode(await this.arrayBuffer());
	}
}

const path_regex = /^[a-zA-Z_$]\w*(\.[a-zA-Z_$]\w*|\[\d+\])*$/;

/**
 * @param {string} path
 */
export function split_path(path) {
	if (!path_regex.test(path)) {
		throw new Error(
			`Invalid field name ${path}` +
				(DEV
					? ': field names are written in JS object notation, so keys that would need quoting are not supported. See https://svelte.dev/docs/kit/remote-functions#form-Fields'
					: '')
		);
	}

	return path.split(/\.|\[|\]/).filter(Boolean);
}

/**
 * Check if a property key is dangerous and could lead to prototype pollution
 * @param {string} key
 */
function check_prototype_pollution(key) {
	if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
		throw new Error(
			`Invalid key "${key}"` +

View on GitHub (pinned to 03f1687fe6)

Solutions

  1. Rename the field to a valid identifier path (letters, digits, underscores, dots, numeric indices).
  2. Map external names (e.g. 'my-field') to valid field names and translate them server-side after parsing.
  3. Sanitize generated names (slugify + identifier-safe transform) before passing them to form.fields.as.

Example fix

// before
fields.as('shipping-address');
// after
fields.as('shippingAddress');
Defensive patterns

Strategy: validation

Validate before calling

const PATH_RE = /^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*|\[\d+\])*$/;
if (!PATH_RE.test(name)) throw new Error(`field name must be valid JS object notation: ${name}`);

Prevention

When it happens

Trigger: Creating a field whose name contains characters outside the allowed path grammar, e.g. form.fields.as('my-field'), 'user name', or keys starting with digits/brackets that fail path_regex.

Common situations: Using database column names with dashes/spaces as field names; names with non-ASCII characters; auto-generating names from arbitrary labels.

Related errors


AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/6c6e87d08bdeb72e. Report an issue: GitHub.