CVE-2026-40073

OVERVIEW CVE-2026-40073 affects SvelteKit versions prior to 2.57.1, specifically applications using the adapter-node deployment configuration. The vulnerability allows attackers to bypass the BODY_SIZE_LIMIT protection mechanism, which is designed to restrict incoming request payload sizes. This bypass is isolated to SvelteKit's internal handling and does not compromise security controls implemented at higher layers such as WAF, gateway, or platform-level protections. SEVERITY The vulnerability carries a CVSS v3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity and represents a denial-of-service risk through availability impact, as oversized requests could consume excessive resources and degrade application performance. The FAUCET Risk Score of 48.0/100 indicates moderate risk, though the extremely low EPSS score of 0.000830 suggests limited real-world exploitation probability. EXPLOITATION STATUS The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and shows no active exploitation activity. It does not appear on the Hot List, indicating minimal community attention or public exploit code availability. Organizations should prioritize upgrading to SvelteKit 2.57.1 or later as a standard maintenance practice rather than an emergency response.