{"id":"GHSA-2crg-3p73-43xp","revision":"ada7bb2ee19940fcb9f2dff0e81fb4ea","records":[{"revision":"ada7bb2ee19940fcb9f2dff0e81fb4ea","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-2crg-3p73-43xp","aliases":["CVE-2026-40073"],"title":"@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass","description":"Under certain circumstances, requests could bypass the `BODY_SIZE_LIMIT` on SvelteKit applications running with `adapter-node`. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.","state":0,"publishedAt":"2026-04-10T17:24:31+00:00","modifiedAt":"2026-04-10T20:04:59.545849+00:00","affected":[{"ecosystem":"npm","name":"@sveltejs/kit","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.57.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp","https://nvd.nist.gov/vuln/detail/CVE-2026-40073","https://github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95","https://github.com/sveltejs/kit","https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.57.1","https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1"],"sourceUrl":"https://github.com/advisories/GHSA-2crg-3p73-43xp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2crg-3p73-43xp","identifiers":["GHSA-2crg-3p73-43xp","CVE-2026-40073"]},"retained":false,"historicalAffected":[]}],"coverage":[]}