A vulnerability in the SvelteKit framework’s adapter-node module allows attackers to submit HTTP requests containing bodies larger than the application‑defined BODY_SIZE_LIMIT. The bypass permits the server to process oversized payloads that would normally be rejected, exposing the application to denial‑of‑service or memory‑pressure attacks. The weakness is categorized as CWE‑770, misuse of resource management.

The impact is limited to applications built with SvelteKit, specifically those using the @sveltejs/adapter-node runtime before the 2.57.1 release. Any deployment of SvelteKit that has not applied the 2.57.1 patch inherits the vulnerability.

This issue carries a CVSS score of 8.2, indicating high severity. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog, though it remains significant. The likely attack vector is any HTTP request carrying a large payload—such as POST, PUT, or PATCH—to the application, which can be performed remotely over standard network connections. Because WAF, gateway, or other platform‑level limits remain unaffected, the attacker can bypass only the application‑level check, but the impact on server resources remains severe.