PT-2026-31989 · Sveltekit+1 · Sveltekit+1

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-40073

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SvelteKit versions prior to 2.57.1

Description SvelteKit, a framework for building web applications, had a potential issue where requests could bypass the BODY SIZE LIMIT when using the adapter-node. This bypass did not impact body size limits enforced by other security measures like Web Application Firewalls (WAFs) or platform-level restrictions.

Recommendations Update to SvelteKit version 2.57.1 or later.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-40073

GHSA-2CRG-3P73-43XP

Affected Products

Sveltekit

Adapter-Node

References · 8

• https://github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95 · Patch
• https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40073 · Security Note
• https://osv.dev/vulnerability/GHSA-2crg-3p73-43xp · Vendor Advisory
• https://github.com/sveltejs/kit · Note
• https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.57.1 · Note
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1 · Note
• https://twitter.com/CVEnew/status/2042710231201775812 · Twitter Post