CVE-2026-40073

Katalog CVE

CVSS 7.5 · High EPSS 0,96%

Kerentanan Allocation of Resources Without Limits or Throttling pada svelte kit. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.

Rincian

Terbit di NVD

10 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sveltejs/kit/security/advisories/GHSA-2crg-3p73-43xp advisory vendor
• https://github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95 patch
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.57.1 product · release notes