Executive brief
SvelteKit's Node.js adapter includes a request body size limit to protect against large payload attacks, but this protection can be bypassed on chunked HTTP requests. An attacker sending malformed or chunked requests could send payloads larger than the configured limit, potentially leading to denial-of-service or resource exhaustion on the application server. However, size limits enforced by external infrastructure (WAF, CDN, load balancer) remain effective.
Technical details
The vulnerability exists in the get_raw_body() function of @sveltejs/adapter-node, which handles HTTP request body parsing. The root cause is improper validation of the BODY_SIZE_LIMIT when processing chunked transfer-encoded requests. Specifically, the code failed to enforce size limits when the Content-Length header was absent and Transfer-Encoding: chunked was used—a legitimate HTTP scenario. The vulnerability requires network access but has low attack complexity; no authentication or user interaction is needed. An attacker can craft HTTP requests with chunked encoding to bypass the body size limit and exhaust application resources. The fix, included in version 2.57.1, adds proper validation to reject oversized requests regardless of the encoding method. A patch is available; upgrade to @sveltejs/kit@2.57.1 or later.
Affected products
- SvelteJS @sveltejs/kit <= 2.57.0
Timeline
- 2026-04-10: disclosed: Published to GitHub Security Advisory
- 2026-04-09: patched: Fix committed; released in @sveltejs/kit@2.57.1
References
- https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp
- https://github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95
- https://github.com/sveltejs/kit
- https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.57.1
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1