CVE-2024-23641

    Dashboard / Vulnerabilities / CVE-2024-23641

    CVE-2024-23641

    Published: 24 Jan 2024Last Modified: 12 Aug 2026

    Summary: Sending a GET or HEAD request with a body crashes SvelteKit

    Details: SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23641.json, https://github.com/sveltejs/kit/security/advisories/GHSA-g5m6-hxpp-fc49, https://nvd.nist.gov/vuln/detail/CVE-2024-23641, https://github.com/sveltejs/kit/commit/af34142631c876a7eb62ff81f71e8a3f90dafee9

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 2ab20205163f303de3c850c2b618259440aabddd
    Fixed -1dd68bde291b7f9da65803c1810c444b8a0a8390

    Affected versions

    4.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-23641 | CVE-DB