CVE-2026-40073: @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass
Under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.
References
- github.com/advisories/GHSA-2crg-3p73-43xp
- github.com/sveltejs/kit
- github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95
- github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.57.1
- github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp
- nvd.nist.gov/vuln/detail/CVE-2026-40073
Code Behaviors & Features
Detect and mitigate CVE-2026-40073 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →