CVE-2026-40073
Last modified
CVE-2026-40073 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. EPSS estimates a 0.54% chance of exploitation in the next 30 days.
Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Svelte | Kit | < 2.57.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-40073?
How severe is CVE-2026-40073?
How do I fix CVE-2026-40073?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-40068In versions 2.1.63 through 2.1.83 of Claude Code, the folder…8.8
- CVE-2026-40069BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.…7.5
- CVE-2026-4007A vulnerability was detected in Tenda W3 1.0.0.3(2204). This…8.8
- CVE-2026-40070BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.…8.1
- CVE-2026-40071pyLoad is a free and open-source download manager written in…5.4
- CVE-2026-40072web3.py allows you to interact with the Ethereum blockchain …7.2
- CVE-2026-40074SvelteKit is a framework for rapidly developing robust, perf…7.5
- CVE-2026-40075OpenMRS Core is an open source electronic medical record sys…7.5
- CVE-2026-40076OpenMRS Core is an open source electronic medical record sys…8.8
- CVE-2026-40077Beszel is a server monitoring platform. Prior to 0.18.7, som…3.1
- CVE-2026-40079Cacti is an open source performance and fault management fra…9.8
- CVE-2026-4008A flaw has been found in Tenda W3 1.0.0.3(2204). This issue …8.8
Are you affected by CVE-2026-40073?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST