PT-2026-31989 · Sveltejs · Kit

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-40073

NVD

CVSS v4.0

8.2

High

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY SIZE LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-40073

Affected Products

Kit

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-40073 · Security Note
• https://github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95 · Note
• https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp · Note
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1 · Note