GHSA-2crg-3p73-43xp
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @sveltejs/kit | < 2.57.1 | 2.57.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Under certain circumstances, requests could bypass the `BODY_SIZE_LIMIT` on SvelteKit applications running with `adapter-node`. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp
- https://nvd.nist.gov/vuln/detail/CVE-2026-40073
- https://github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95
- https://github.com/sveltejs/kit
- https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.57.1
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]