SvelteKit BODY_SIZE_LIMIT Bypass Vulnerability in Adapter-Node

A vulnerability in SvelteKit applications using adapter-node, prior to version 2.57.1, allowed certain requests to bypass the BODY_SIZE_LIMIT. This issue does not impact body size limits enforced at other layers, such as in the WAF, gateway, or platform level.

Impact

Exploitation of this vulnerability could lead to a denial-of-service condition by allowing requests to exceed the intended body size limit, potentially causing the application to handle excessively large payloads improperly.

Reproduction

The vulnerability can be reproduced by sending a chunked HTTP request that exceeds the BODY_SIZE_LIMIT while using the SvelteKit adapter-node. The application will not enforce the size limit, allowing the request to be processed despite its large size.

Remediation

Users can upgrade to SvelteKit version 2.57.1 or later, where this vulnerability has been fixed.