VulnerabilityAnalyzed

CVE-2026-40073

Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node.

HIGH 8.2EPSS 0.54%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.54%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.

CVSS 4.0: 8.2 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.54% probability · 44th percentile
CISA KEV: Not listed
Weakness: CWE-770
Affected: svelte/kit
Source: security-advisories@github.com

References

https://github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95Patch
https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1Product, Release Notes
https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xpVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.