All vulnerabilities
CVE-2024-23641GHSA-g5m6-hxpp-fc49

@sveltejs/kit: Sending a GET or HEAD request with a body crashes SvelteKit

sveltejs @sveltejs/kitnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Nov 2024. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.76%Chance of exploitation activity in the next 30 days, higher than 54% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.4.3Also 2.1.2, 3.0.3 and 1 moreGitHub
Published24 Jan 2024Updated 18 Oct 2026CVE List

What fixes it

  • 2.4.3@sveltejs/kit, npmGitHubnpm install @sveltejs/kit@2.4.3
  • 2.1.2@sveltejs/adapter-node, npmGitHubnpm install @sveltejs/adapter-node@2.1.2
  • 3.0.3@sveltejs/adapter-node, npmGitHubnpm install @sveltejs/adapter-node@3.0.3
  • 4.0.1@sveltejs/adapter-node, npmGitHubnpm install @sveltejs/adapter-node@4.0.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD method cannot have body. and crashes the app.

node:internal/deps/undici/undici:6066
          throw new TypeError("Request with GET/HEAD method cannot have body.");
                ^

TypeError: Request with GET/HEAD method cannot have body.
    at new Request (node:internal/deps/undici/undici:6066:17)
    at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/node/index.js:107:9)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:181:26
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:172:6
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:211:27
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)

Node.js v20.11.0

TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.

<!--

Details

_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ -->

PoC

<!-- _Complete instructions, including specific configuration details, to reproduce the vulnerability._ --> First do a fresh install of SvelteKit 2 with the example app. Typescript.

  1. npm run build
  2. npm run preview
  3. Go to http://localhost:4173 (works)
  4. curl -X GET -d "{}" http://localhost:4173/bye
  5. Application crashes and http://localhost:4173 is down

Impact

<!-- _What kind of vulnerability is it? Who is impacted?_ --> Denial of Service for apps using adapter-node

Text from GitHub Advisory Database

Affected versions 13

  • @sveltejs/kit, npm>= 2.0.0, < 2.4.3GitHub
  • @sveltejs/adapter-node, npm>= 2.0.0, < 2.1.2GitHub
  • @sveltejs/adapter-node, npm>= 3.0.0, < 3.0.3GitHub
  • @sveltejs/adapter-node, npm= 4.0.0GitHub
  • kitaffected: >= 2.0.0, < 2.4.3CVE List
  • kitaffected: >= 2.0.0, < 2.1.2CVE List
  • kitaffected: >= 3.0.0, < 3.0.3CVE List
  • kitaffected: = 4.0.0CVE List
  • @sveltejs/kit, npmfrom 2.0.0, fixed in 2.4.3OSV
  • @sveltejs/adapter-node, npmfrom 2.0.0, fixed in 2.1.2OSV
  • @sveltejs/adapter-node, npmfrom 3.0.0, fixed in 3.0.3OSV
  • @sveltejs/adapter-node, npmfrom 4.0.0, fixed in 4.0.1OSV
  • @sveltejs/adapter-node, npm4.0.0OSV

References 4