EUVD-2026-21502
GHSA-2crg-3p73-43xp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft oversized HTTP request body
-
ExploitBypass BODY_SIZE_LIMIT validation in adapter-node
-
ImpactTrigger denial of service via resource exhaustion
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | SvelteKit versions prior to 2.57.1 using adapter-node. Remote unauthenticated attacker sends crafted requests exploiting timing conditions (AT:P) to bypass BODY_SIZE_LIMIT. No victim interaction required. WAF/gateway/platform-level limits unaffected. |
| Impact | Unauthenticated attacker can bypass BODY_SIZE_LIMIT on adapter-node deployments, enabling resource exhaustion denial-of-service. CVSS 8.2 reflects high availability impact; however, upstream WAF/gateway/platform-level limits remain effective. Risk priority depends on deployment architecture-direct exposure to untrusted networks elevates concern; organizations using intermediate protections face reduced blast radius. |
| Exploit ScenarioDerived | Attacker sends oversized HTTP request body to SvelteKit application running adapter-node prior to 2.57.1. Request bypasses application-level BODY_SIZE_LIMIT constraint, consuming server resources and causing denial-of-service. Mitigation: upgrade to version 2.57.1 or enforce size limits at WAF/gateway layer. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads, causing denial of service through resource exhaustion. Affects SvelteKit versions prior to 2.57.1 running adapter-node. Exploitation requires specific timing conditions (CVSS AT:P). Platform-level and WAF body size limits remain effective. No public exploit identified at time of analysis. Vulnerability exploits CWE-770 resource allocation flaw where BODY_SIZE_LIMIT enforcement fails under race conditions or specific request patterns.
RemediationAI
Vendor-released patch: upgrade SvelteKit to version 2.57.1 or later. Apply update via npm/yarn: npm install @sveltejs/kit@2.57.1 or yarn upgrade @sveltejs/kit@2.57.1. Patch fixes body size validation race condition identified in commit 3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95. Workaround: enforce body size limits at reverse proxy, WAF, or platform layer (e.g., nginx client_max_body_size, AWS ALB request size limits). Monitor application memory usage for anomalies. Release advisory: https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp. Confirm deployment uses adapter-node before prioritizing; other adapters not vulnerable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-770 resource allocation flaw in adapter-node's request body handling. Under specific timing conditions (CVSS AT:P), the BODY_SIZE_LIMIT validation is bypassed before stream processing, allowing unbounded memory consumption. Root cause traced to commit 3202ed6 addressing race condition in body size enforcement logic. Affects cpe:2.3:a:sveltejs:kit applications using Node.js adapter exclusively.
Know when Kit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.
Executive ViewAI
CVE-2026-40073 is a denial-of-service vulnerability in SvelteKit's adapter-node that allows unauthenticated attackers to bypass request body size limits and exhaust server resources. Organizations running SvelteKit versions prior to 2.57.1 with adapter-node face service availability risk if request validation controls are the primary defense mechanism; however, platform-level and Web Application Firewall protections remain effective mitigations.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce request body size limits at WAF layer (e.g., AWS WAF, Cloudflare, ModSecurity), configure platform-level limits on application servers (nginx, reverse proxy body_limit directives), and implement rate limiting on POST/PUT endpoints. These controls are effective because the vulnerability requires specific timing conditions and cannot bypass infrastructure-level protections.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in SvelteKit Request Handling Vulnerabilities
View all 2SvelteKit is a web development kit. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authe
Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a
SvelteKit 2.19.0-2.49.4 has SSRF/DoS affecting applications with prerendered routes. Can be exploited to make the server
A path traversal vulnerability in SvelteKit's Vite preview server on Windows (versions 2.10.0 before 3.0.0) allows remot
Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who subm
CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers
Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the s
SvelteKit versions 2.49.0 through 2.49.4 are vulnerable to denial-of-service attacks through the experimental form remot
Server-side request forgery in SvelteKit before 3.0.0 allows unauthenticated remote attackers to abuse the framework's s
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition i
Exploit-DB