Sending a GET or HEAD request with a body crashes SvelteKit
CVE-2024-23641

7.5HIGH

Key Information:

Vendor

sveltejs

Status
kit
Vendor
CVE Published:
24 January 2024

What is CVE-2024-23641?

SvelteKit 2, a popular web development framework, is vulnerable to a situation where sending a GET request with a body, such as an empty object {}, leads to an application crash. This behavior is triggered when the app is built and hosted and results in an error message: 'Request with GET/HEAD method cannot have body.' Additionally, using TRACE requests can cause similar crashes. Once the application crashes, a manual restart is necessary to resume operations. Notably, prerendered pages and SvelteKit 1 applications remain unaffected by this issue. Corrective actions have been implemented in specific versions of @sveltejs/adapter-node and @sveltejs/kit to address these concerns.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

kit >= 2.0.0, < 2.4.3 < 2.0.0, 2.4.3

kit >= 2.0.0, < 2.1.2 < 2.0.0, 2.1.2

kit >= 3.0.0, < 3.0.3 < 3.0.0, 3.0.3

References

https://github.com/sveltejs/kit/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/sveltejs/kit/commit/af34142631c876a7eb...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.