CVE-2026-40073: SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODYSIZELIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.
Other sources
Under certain circumstances, requests could bypass the BODYSIZELIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40073?
CVE-2026-40073 is considered a medium severity vulnerability due to its potential to bypass security controls.
How do I fix CVE-2026-40073?
To fix CVE-2026-40073, upgrade the @sveltejs/kit package to version 2.57.1 or later.
What does CVE-2026-40073 affect?
CVE-2026-40073 affects SvelteKit applications running with the @sveltejs/adapter-node package.
What is the nature of the vulnerability in CVE-2026-40073?
CVE-2026-40073 is a BODY_SIZE_LIMIT bypass that can allow unauthorized data submission.
When was CVE-2026-40073 reported?
CVE-2026-40073 was publicly disclosed before the release of version 2.57.1 of @sveltejs/kit.