---
id: "CVE-2024-23641"
kind: "vulnerability"
aliases: ["CVE-2024-23641", "GHSA-g5m6-hxpp-fc49"]
title: "Sending a GET or HEAD request with a body crashes SvelteKit"
severity: "high"
cvss: 7.5
epss: 0.007639999967068434
exploited: false
status: "open"
category: "package"
products: [{"name": "@sveltejs/kit", "fixed": ["2.4.3"], "affected": ">= 2.0.0, < 2.4.3", "ecosystem": "npm"}, {"name": "@sveltejs/adapter-node", "fixed": ["2.1.2"], "affected": ">= 2.0.0, < 2.1.2", "ecosystem": "npm"}, {"name": "@sveltejs/adapter-node", "fixed": ["3.0.3"], "affected": ">= 3.0.0, < 3.0.3", "ecosystem": "npm"}, {"name": "@sveltejs/adapter-node", "fixed": ["4.0.1"], "affected": "= 4.0.0", "ecosystem": "npm"}, {"name": "svelte adapter-node", "fixed": ["2.1.2"], "affected": ">= 2.0.0, < 2.1.2", "ecosystem": "vendor"}, {"name": "svelte adapter-node", "fixed": ["3.0.3"], "affected": ">= 3.0.0, < 3.0.3", "ecosystem": "vendor"}, {"name": "svelte adapter-node", "fixed": [], "affected": "= 4.0.0", "ecosystem": "vendor"}, {"name": "svelte kit", "fixed": ["2.4.3"], "affected": ">= 2.0.0, < 2.4.3", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["adapter-node", "cwe-20", "node", "package", "self-hosted", "sveltekit"]
not_affected_if: ["managed-hosting", "prerendered-only", "static-export", "sveltekit-1"]
published_at: "2024-01-24T14:22:22+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-g5m6-hxpp-fc49", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23641", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Sending a GET or HEAD request with a body crashes SvelteKit

SvelteKit 2 apps crash when they receive a GET, HEAD or TRACE request that carries a body, because the request constructor throws an uncaught TypeError. An unauthenticated remote client can take the app down repeatedly with one request.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@sveltejs/kit affected >= 2.0.0, < 2.4.3 fixed 2.4.3
- npm:@sveltejs/adapter-node affected >= 2.0.0, < 2.1.2 fixed 2.1.2
- npm:@sveltejs/adapter-node affected >= 3.0.0, < 3.0.3 fixed 3.0.3
- npm:@sveltejs/adapter-node affected = 4.0.0 fixed 4.0.1
- vendor:svelte adapter-node affected >= 2.0.0, < 2.1.2 fixed 2.1.2
- vendor:svelte adapter-node affected >= 3.0.0, < 3.0.3 fixed 3.0.3
- vendor:svelte adapter-node affected = 4.0.0 fixed ?
- vendor:svelte kit affected >= 2.0.0, < 2.4.3 fixed 2.4.3

## How to check

Check the installed version: npm ls @sveltejs/kit @sveltejs/adapter-node
Confirm the app uses adapter-node or runs under vite preview (prerendered pages and SvelteKit 1 are not affected).

## Fix

Upgrade @sveltejs/kit to 2.4.3 or later and @sveltejs/adapter-node to 2.1.2, 3.0.3 or 4.0.1 depending on the major line.
Rebuild and redeploy the app after upgrading.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-g5m6-hxpp-fc49
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-23641

## From the sources

### Summary
In SvelteKit 2 sending a GET request with a body eg `{}` to a SvelteKit app in preview or with `adapter-node` throws `Request with GET/HEAD method cannot have body.` and crashes the app.

```
node:internal/deps/undici/undici:6066
          throw new TypeError("Request with GET/HEAD method cannot have body.");
                ^

TypeError: Request with GET/HEAD method cannot have body.
    at new Request (node:internal/deps/undici/undici:6066:17)
    at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/node/index.js:107:9)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:181:26
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:172:6
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:211:27
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)

Node.js v20.11.0
```

`TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.

<!--
### Details
_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._
-->
### PoC
<!-- _Complete instructions, including specific configuration details, to reproduce the vulnerability._ -->
First do a fresh install of SvelteKit 2 with the example app. Typescript.

1. `npm run build`
2. `npm run preview`
3. Go to http://localhost:4173 (works)
4. curl -X GET -d "{}" http://localhost:4173/bye
5. Application crashes and http://localhost:4173 is down

### Impact
<!-- _What kind of vulnerability is it? Who is impacted?_ -->
Denial of Service for apps using `adapter-node`

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_