CVE-2026-40073

The record

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.

Affected packages

Related vulnerabilities

• GHSA-2crg-3p73-43xp @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass Same vulnerability
• GHSA-hgv7-v322-mmgr @sveltejs/kit: `query.batch` cross-talk Also affects @sveltejs/kit
• GHSA-3f6h-2hrp-w5wx @sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service Also affects @sveltejs/kit
• CVE-2026-40074 SvelteKit is a framework for rapidly developing robust, performant web applications using… Also affects @sveltejs/kit
• GHSA-fpg4-jhqr-589c SvelteKit has deserialization expansion in unvalidated `form` remote function leading to… Also affects @sveltejs/kit
• GHSA-88qp-p4qg-rqm6 CPU exhaustion in SvelteKit remote form deserialization (experimental only) Also affects @sveltejs/kit
• GHSA-vrhm-gvg7-fpcf Memory exhaustion in SvelteKit remote form deserialization (experimental only) Also affects @sveltejs/kit
• GHSA-j2f3-wq62-6q46 @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form… Also affects @sveltejs/kit