Description
Under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.57.0
- Patched version(s): 2.57.1
References
Could your website be exposed too?
SmartScanner can check your website for @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
- @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve - CVE-2026-22803
- LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
- LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body - CVE-2026-44645
You might also like:
See something that needs correcting? Let us knowUpdated April 10, 2026