Packages / @sveltejs/kit / Security

HighVulnerabilityGHSA-2crg-3p73-43xpCVE-2026-40073Published 10 Apr 2026

@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass

Affected releases · @sveltejs/kit

  • 2.x2.0.0 – 2.57.0Fixed in 2.57.1
  • 1.x and older0.0.8 – 1.30.4No fix, no longer updated

On 2.x, the newest line:

npm install @sveltejs/kit@2.57.1
3.x

  1. Not affected

    3.0.0 – 3.1.0

    3 releases, latest

2.x

  1. Affected

    2.0.0 – 2.57.0

    211 releases

  2. Fixed

    2.57.1 – 2.70.3

    26 releases

1.x

  1. Affected

    1.0.0 – 1.30.4

    128 releases

0.x

  1. Affected

    0.0.8 – 0.0.30

    21 releases

389 stable releases of @sveltejs/kit, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @sveltejs/kit. It is read in your browser and sent nowhere.

What happens

Under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.