high · 7.5 Patched

Sending a GET or HEAD request with a body crashes SvelteKit

CVE-2024-23641 · GHSA-g5m6-hxpp-fc49 · published 24 Jan 2024

How serious is it

  • Severity: high, CVSS score 7.5 out of 10.
  • No exploit prediction (EPSS) score yet.
  • Not on the CISA list of exploited vulnerabilities.
  • No public exploit in Exploit-DB.

Is your app affected by CVE-2024-23641?

Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.

Who is affected

  • @sveltejs/kit (npm) >= 2.0.0, < 2.4.3
  • @sveltejs/adapter-node (npm) >= 2.0.0, < 2.1.2
  • @sveltejs/adapter-node (npm) >= 3.0.0, < 3.0.3
  • @sveltejs/adapter-node (npm) = 4.0.0

How to check

  1. Run npm ls @sveltejs/kit in your project to see the installed version, including copies pulled in by other packages.
  2. Run npm ls @sveltejs/adapter-node in your project to see the installed version, including copies pulled in by other packages.
  3. Or paste your lockfile into the checker: it lists every package with a known vulnerability, this one included.
  4. Or run npx shippable-dev scan localhost:3000 in your project folder. It reads your lockfile and flags this vulnerability along with every other known one.

How to fix

Copies a prompt for Claude Code, Cursor or Codex: it checks your lockfiles for this and upgrades it.
  1. On >= 2.0.0, < 2.4.3: Upgrade @sveltejs/kit to 2.4.3 or later, commit the lockfile and redeploy.
  2. On >= 2.0.0, < 2.1.2: Upgrade @sveltejs/adapter-node to 2.1.2 or later, commit the lockfile and redeploy.
  3. On >= 3.0.0, < 3.0.3: Upgrade @sveltejs/adapter-node to 3.0.3 or later, commit the lockfile and redeploy.
  4. On = 4.0.0: Upgrade @sveltejs/adapter-node to 4.0.1 or later, commit the lockfile and redeploy.
  5. If a vulnerable version was live, check your logs and rotate the secrets that server could read.

The advisory

### Summary In SvelteKit 2 sending a GET request with a body eg `{}` to a SvelteKit app in preview or with `adapter-node` throws `Request with GET/HEAD method cannot have body.` and crashes the app. ``` node:internal/deps/undici/undici:6066 throw new TypeError("Request with GET/HEAD method cannot have body."); ^ TypeError: Request with GET/HEAD method cannot have body. at new Request (node:internal/deps/undici/undici:6066:17) at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/node/index.js:107:9) at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:181:26 at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7) at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5) at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:172:6 at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7) at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5) at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:211:27 at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7) Node.js v20.11.0 ``` `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. <!-- ### Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ --> ### PoC <!-- _Complete instructions, including specific configuration details, to reproduce the vulnerability._ --> First do a fresh install of SvelteKit 2 with the example app. Typescript. 1. `npm run build` 2. `npm run preview` 3. Go to http://localhost:4173 (works) 4. curl -X GET -d "{}" http://localhost:4173/bye 5. Application crashes and http://localhost:4173 is down ### Impact <!-- _What kind of vulnerability is it? Who is impacted?_ --> Denial of Service for apps using `adapter-node`

Check your whole app

Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.

References

Merged from GitHub Advisory Database. Last updated 23 Oct 2026. All vulnerabilities · RSS · JSON

Get alerts for new exploited vulnerabilities