Live › vulnerability › CVE-2024-23641
Go to dashboardSvelteKit 2 apps crash when they receive a GET, HEAD or TRACE request that carries a body, because the request constructor throws an uncaught TypeError. An unauthenticated remote client can take the app down repeatedly with one request.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| @sveltejs/kit | npm | >= 2.0.0, < 2.4.3 | 2.4.3 |
| @sveltejs/adapter-node | npm | >= 2.0.0, < 2.1.2 | 2.1.2 |
| @sveltejs/adapter-node | npm | >= 3.0.0, < 3.0.3 | 3.0.3 |
| @sveltejs/adapter-node | npm | = 4.0.0 | 4.0.1 |
| svelte adapter-node | vendor | >= 2.0.0, < 2.1.2 | 2.1.2 |
| svelte adapter-node | vendor | >= 3.0.0, < 3.0.3 | 3.0.3 |
| svelte adapter-node | vendor | = 4.0.0 | – |
| svelte kit | vendor | >= 2.0.0, < 2.4.3 | 2.4.3 |
Check the installed version: npm ls @sveltejs/kit @sveltejs/adapter-node Confirm the app uses adapter-node or runs under vite preview (prerendered pages and SvelteKit 1 are not affected).
2.4.3 or later and @sveltejs/adapter-node to 2.1.2, 3.0.3 or 4.0.1 depending on the major lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD method cannot have body. and crashes the app.
node:internal/deps/undici/undici:6066
throw new TypeError("Request with GET/HEAD method cannot have body.");
^
TypeError: Request with GET/HEAD method cannot have body.
at new Request (node:internal/deps/undici/undici:6066:17)
at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/node/index.js:107:9)
at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:181:26
at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:172:6
at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:211:27
at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
Node.js v20.11.0
TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.
First do a fresh install of SvelteKit 2 with the example app. Typescript.
npm run buildnpm run previewDenial of Service for apps using adapter-node
This page as .md · .json · in your agent: get_signal("CVE-2024-23641")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.