EUVD-2026-21502
GHSA-2crg-3p73-43xp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.
AnalysisAI
Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads, causing denial of service through resource exhaustion. Affects SvelteKit versions prior to 2.57.1 running adapter-node. Exploitation requires specific timing conditions (CVSS AT:P). Platform-level and WAF body size limits remain effective. No public exploit identified at time of analysis. Vulnerability exploits CWE-770 resource allocation flaw where BODY_SIZE_LIMIT enforcement fails under race conditions or specific request patterns.
Technical ContextAI
CWE-770 resource allocation flaw in adapter-node's request body handling. Under specific timing conditions (CVSS AT:P), the BODY_SIZE_LIMIT validation is bypassed before stream processing, allowing unbounded memory consumption. Root cause traced to commit 3202ed6 addressing race condition in body size enforcement logic. Affects cpe:2.3:a:sveltejs:kit applications using Node.js adapter exclusively.
RemediationAI
Vendor-released patch: upgrade SvelteKit to version 2.57.1 or later. Apply update via npm/yarn: npm install @sveltejs/kit@2.57.1 or yarn upgrade @sveltejs/kit@2.57.1. Patch fixes body size validation race condition identified in commit 3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95. Workaround: enforce body size limits at reverse proxy, WAF, or platform layer (e.g., nginx client_max_body_size, AWS ALB request size limits). Monitor application memory usage for anomalies. Release advisory: https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp. Confirm deployment uses adapter-node before prioritizing; other adapters not vulnerable.
SvelteKit is a web development kit. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authe
Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a
SvelteKit 2.19.0-2.49.4 has SSRF/DoS affecting applications with prerendered routes. Can be exploited to make the server
Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who subm
CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers
Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the s
SvelteKit versions 2.49.0 through 2.49.4 are vulnerable to denial-of-service attacks through the experimental form remot
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers
SvelteKit versions prior to 2.57.1 are vulnerable to denial of service when the redirect() function is called from the h
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition i
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from Java
Unauthenticated broken access control in the Kit (formerly ConvertKit) WordPress plugin versions up to and including 3.3
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today