CVE-2026-40073

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.

CVSS 4.0

8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-25)

CWE

CWE-770

Published

2026-04-10

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

Affected

• svelte:kit

Packages (OSV)

References

• https://github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1
• https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp

Check your stackJSON