CVE-2026-40073 SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node
Attackers can bypass body size limits in SvelteKit applications using adapter-node, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40073?
CVE-2026-40073 is a high-severity vulnerability in sveltejs kit, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.
Weakness: CWE-770
Which versions are affected by CVE-2026-40073?
2 open source packages ship an affected version, including @sveltejs/kit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@sveltejs/kit npm | All versions | 2.57.1 |
@sveltejs/kit npm | All versions | 2.57.1 |
Products include Svelte Kit.
How do I fix CVE-2026-40073?
Upgrade @sveltejs/kit to 2.57.1 or later.
Is CVE-2026-40073 being exploited?
There is no known exploitation of CVE-2026-40073 in the wild and no public exploit code.
Other vulnerabilities in sveltejs kit
Sources
Also known as GHSA-2crg-3p73-43xp.