{"id":"CVE-2024-23641","summary":"Sending a GET or HEAD request with a body crashes SvelteKit","details":"SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.","aliases":["GHSA-g5m6-hxpp-fc49"],"modified":"2026-08-12T03:51:11.493419463Z","published":"2024-01-24T16:56:32.392Z","database_specific":{"cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23641.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23641.json"},{"type":"ADVISORY","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-g5m6-hxpp-fc49"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23641"},{"type":"FIX","url":"https://github.com/sveltejs/kit/commit/af34142631c876a7eb62ff81f71e8a3f90dafee9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sveltejs/kit","events":[{"introduced":"2ab20205163f303de3c850c2b618259440aabddd"},{"fixed":"1dd68bde291b7f9da65803c1810c444b8a0a8390"},{"fixed":"40e85888d7cf53fb4c92bdca9efaa79c1fe5c682"},{"fixed":"a93e19b0022491e7979a5b36f2275ac0e1f927f8"},{"introduced":"ee898a9d90c89149d96f05e749cdd3839f79d95a"},{"fixed":"af34142631c876a7eb62ff81f71e8a3f90dafee9"}],"database_specific":{"extracted_events":[{"introduced":"2.0.0"},{"fixed":"2.1.2"},{"introduced":"3.0.0"},{"fixed":"3.0.3"},{"fixed":"2.4.3"},{"introduced":"4.0.0"},{"last_affected":"4.0.0"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:svelte:adapter-node:*:*:*:*:*:node.js:*:*","cpe:2.3:a:svelte:kit:*:*:*:*:*:node.js:*:*","cpe:2.3:a:svelte:adapter-node:4.0.0:*:*:*:*:node.js:*:*"]}}],"versions":["4.0.0","= 4.0.0","create-svelte@5.3.4","@sveltejs/kit@2.4.2","@sveltejs/adapter-auto@3.1.1","@sveltejs/kit@2.4.1","@sveltejs/adapter-vercel@5.1.0","@sveltejs/adapter-netlify@4.1.0","@sveltejs/kit@2.4.0","@sveltejs/adapter-vercel@5.0.0","@sveltejs/adapter-node@4.0.0","@sveltejs/adapter-netlify@4.0.0","@sveltejs/adapter-cloudflare@4.1.0","@sveltejs/adapter-cloudflare-workers@2.1.0","@sveltejs/adapter-cloudflare@4.0.2","@sveltejs/kit@2.3.5","@sveltejs/kit@2.3.4","create-svelte@6.0.8","@sveltejs/adapter-vercel@4.0.5","@sveltejs/adapter-node@3.0.1","@sveltejs/adapter-netlify@3.0.2","@sveltejs/adapter-cloudflare@4.0.1","@sveltejs/adapter-cloudflare-workers@2.0.3","create-svelte@6.0.7","@sveltejs/package@2.2.6","@sveltejs/kit@2.3.3","@sveltejs/adapter-cloudflare@4.0.0","@sveltejs/kit@2.3.2","@sveltejs/adapter-cloudflare@3.0.2","@sveltejs/adapter-cloudflare-workers@2.0.2","@sveltejs/kit@2.3.1","@sveltejs/enhanced-img@0.1.8","@sveltejs/adapter-node@3.0.0","@sveltejs/kit@2.3.0","@sveltejs/kit@2.2.2","@sveltejs/adapter-node@2.1.1","@sveltejs/kit@2.2.1","@sveltejs/kit@2.2.0","@sveltejs/kit@2.1.2","@sveltejs/kit@2.1.1","@sveltejs/adapter-node@2.1.0","@sveltejs/kit@2.1.0","@sveltejs/kit@2.0.8","create-svelte@6.0.6","@sveltejs/kit@2.0.7","@sveltejs/adapter-vercel@4.0.4","@sveltejs/adapter-auto@3.1.0","@sveltejs/package@2.2.5","create-svelte@6.0.5","@sveltejs/kit@2.0.6","@sveltejs/kit@2.0.5","@sveltejs/adapter-node@2.0.2","svelte-migrate@1.3.6","svelte-migrate@1.3.5","create-svelte@6.0.4","@sveltejs/package@2.2.4","@sveltejs/kit@2.0.4","@sveltejs/enhanced-img@0.1.7","@sveltejs/adapter-vercel@4.0.3","@sveltejs/adapter-static@3.0.1","@sveltejs/adapter-node@2.0.1","@sveltejs/adapter-netlify@3.0.1","@sveltejs/adapter-cloudflare@3.0.1","@sveltejs/adapter-cloudflare-workers@2.0.1","@sveltejs/adapter-auto@3.0.1","svelte-migrate@1.3.4","create-svelte@6.0.3","@sveltejs/kit@2.0.3","create-svelte@6.0.2","@sveltejs/kit@2.0.2","create-svelte@6.0.1","@sveltejs/kit@2.0.1","@sveltejs/adapter-vercel@4.0.2","svelte-migrate@1.3.3","svelte-migrate@1.3.2","@sveltejs/adapter-vercel@4.0.1","svelte-migrate@1.3.1","svelte-migrate@1.3.0","create-svelte@6.0.0","@sveltejs/kit@2.0.0","@sveltejs/enhanced-img@0.1.6","@sveltejs/amp@1.1.0","@sveltejs/adapter-vercel@4.0.0","@sveltejs/adapter-static@3.0.0","@sveltejs/adapter-node@2.0.0","@sveltejs/adapter-netlify@3.0.0","@sveltejs/adapter-cloudflare@3.0.0","@sveltejs/adapter-cloudflare-workers@2.0.0","@sveltejs/adapter-auto@3.0.0","@sveltejs/kit@1.30.3","@sveltejs/kit@1.30.2","@sveltejs/kit@1.30.1","@sveltejs/kit@1.30.0","@sveltejs/kit@1.29.1","@sveltejs/kit@1.29.0","@sveltejs/kit@1.28.0","@sveltejs/adapter-cloudflare-workers@1.2.3","svelte-migrate@1.2.8","create-svelte@5.3.3","@sveltejs/kit@1.27.7","@sveltejs/adapter-cloudflare@2.3.4","@sveltejs/adapter-cloudflare-workers@1.2.2","create-svelte@5.3.2","@sveltejs/package@2.2.3","@sveltejs/enhanced-img@0.1.5","@sveltejs/adapter-vercel@3.1.0","@sveltejs/enhanced-img@0.1.4","create-svelte@5.3.1","@sveltejs/enhanced-img@0.1.3","create-svelte@5.3.0","@sveltejs/kit@1.27.6","@sveltejs/enhanced-img@0.1.2","create-svelte@5.2.0","@sveltejs/adapter-cloudflare-workers@1.2.1","@sveltejs/kit@1.27.5","@sveltejs/enhanced-img@0.1.1","@sveltejs/kit@1.27.4","@sveltejs/kit@1.27.3","@sveltejs/adapter-auto@2.1.1","@sveltejs/kit@1.27.2","@sveltejs/adapter-cloudflare-workers@1.2.0","@sveltejs/kit@1.27.1","@sveltejs/kit@1.27.0","@sveltejs/kit@1.26.0","create-svelte@5.1.1","@sveltejs/kit@1.25.2","svelte-migrate@1.2.7","create-svelte@5.1.0","@sveltejs/kit@1.25.1","create-svelte@5.0.6","@sveltejs/kit@1.25.0","@sveltejs/kit@1.24.1","@sveltejs/kit@1.24.0","@sveltejs/kit@1.23.1","@sveltejs/package@2.2.2","@sveltejs/kit@1.23.0","@sveltejs/adapter-cloudflare@2.3.3","@sveltejs/kit@1.22.6","create-svelte@5.0.5","@sveltejs/package@2.2.1","@sveltejs/kit@1.22.5","create-svelte@5.0.4","@sveltejs/kit@1.22.4","@sveltejs/adapter-vercel@3.0.3","@sveltejs/adapter-cloudflare@2.3.2","@sveltejs/adapter-cloudflare-workers@1.1.4","@sveltejs/adapter-static@2.0.3","@sveltejs/kit@1.22.3","svelte-migrate@1.2.6","create-svelte@5.0.3","@sveltejs/package@2.2.0","@sveltejs/kit@1.22.2","@sveltejs/adapter-vercel@3.0.2","@sveltejs/adapter-netlify@2.0.8","@sveltejs/adapter-cloudflare@2.3.1","@sveltejs/adapter-cloudflare-workers@1.1.3","svelte-migrate@1.2.5","@sveltejs/kit@1.22.1","@sveltejs/kit@1.22.0","@sveltejs/adapter-node@1.3.1","@sveltejs/adapter-node@1.3.0","create-svelte@5.0.2","@sveltejs/kit@1.21.0","svelte-migrate@1.2.4","create-svelte@5.0.1","@sveltejs/package@2.1.0","@sveltejs/kit@1.20.5","svelte-migrate@1.2.3","create-svelte@5.0.0","svelte-migrate@1.2.2","@sveltejs/kit@1.20.3","@sveltejs/kit@1.20.2","@sveltejs/kit@1.20.1","@sveltejs/adapter-vercel@3.0.1","svelte-migrate@1.2.1","svelte-migrate@1.2.0","@sveltejs/kit@1.20.0","@sveltejs/kit@1.19.0","@sveltejs/adapter-cloudflare@2.3.0","@sveltejs/kit@1.18.0","@sveltejs/kit@1.17.1","@sveltejs/adapter-cloudflare@2.2.4","@sveltejs/adapter-auto@2.1.0","@sveltejs/kit@1.17.0","@sveltejs/adapter-vercel@3.0.0","@sveltejs/adapter-cloudflare@2.2.3","@sveltejs/adapter-cloudflare-workers@1.1.2","@sveltejs/kit@1.16.2","@sveltejs/kit@1.16.3","create-svelte@4.2.0","@sveltejs/kit@1.16.1","@sveltejs/kit@1.16.0","@sveltejs/kit@1.15.11","@sveltejs/adapter-cloudflare@2.2.2","create-svelte@4.1.1","@sveltejs/kit@1.15.10","create-svelte@4.1.0","@sveltejs/adapter-vercel@2.4.3","@sveltejs/adapter-node@1.2.4","@sveltejs/adapter-netlify@2.0.7","@sveltejs/adapter-cloudflare@2.2.1","@sveltejs/adapter-cloudflare-workers@1.1.1","create-svelte@4.0.0","@sveltejs/kit@1.15.9","@sveltejs/adapter-vercel@2.1.0","svelte-migrate@1.1.3","@sveltejs/kit@1.8.3","@sveltejs/kit@1.8.2","@sveltejs/kit@1.8.1","svelte-migrate@1.1.2","@sveltejs/package@2.0.2","create-svelte@3.0.2","@sveltejs/kit@1.8.0","@sveltejs/kit@1.7.2","@sveltejs/adapter-vercel@2.0.4","@sveltejs/adapter-vercel@2.0.3","create-svelte@3.0.1","svelte-migrate@1.1.1","@sveltejs/package@2.0.1","svelte-migrate@1.1.0","create-svelte@3.0.0","@sveltejs/package@2.0.0","@sveltejs/kit@1.7.1","@sveltejs/adapter-netlify@2.0.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23641.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}