CVE-2026-40073 HIGH

CVE-2026-40073: SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node

Vendor Sveltejs
Product kit
Weakness CWE-770 · Uncontrolled resource consumption
Published April 10, 2026
Last update April 13, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.

Key dates

02Disclosure timeline

April 10, 2026 CVE published
April 13, 2026 Record updated