CVE-2026-40073CWE-770

SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node

High · published April 10, 2026

CVSS v4.0
8.2
EPSS
1%
Percentile
61.0
In the wild
Unconfirmed
What it is

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00955 · 61.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-04-10T16:24Z
EPSS history
Timeline
  • 10 APR 16:24Z
    SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node
    cvelistv5