GitHub Advisoryadvisory · npm

GHSA-2crg-3p73-43xp @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass

HIGH Published 2026-04-10 Modified 2026-04-10 Official page ↗
Aliases
CVE-2026-40073
Ecosystem
npm
Packages
@sveltejs/kit
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-770
Reviewed
2026-04-10

Affected packages

• npm @sveltejs/kit: < 2.57.1 → fixed in 2.57.1

Description

Under certain circumstances, requests could bypass the `BODY_SIZE_LIMIT` on SvelteKit applications running with `adapter-node`. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.

Related

Alias · CVE (1)

  • CVE-2026-40073 SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References