CVE-2024-23641
High
Description
SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Svelte Adapter-node
PublishedJan 24, 2024
First seenJan 24, 2024
Weakness typeCWE-20Improper input validation
How to fix
Update
- svelte adapter-node2.1.2, 3.0.3 or later
- svelte kit2.4.3 or later
- @sveltejs/kit2.4.3 or later
- @sveltejs/adapter-node2.1.2, 3.0.3, 4.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| svelte adapter-node | 2.0.0 ≤ v < 2.1.2, 3.0.0 ≤ v < 3.0.3, 4.0.0 | 2.1.2, 3.0.3 |
| svelte kit | 2.0.0 ≤ v < 2.4.3 | 2.4.3 |
| @sveltejs/kitnpm | 2.0.0 ≤ v < 2.4.3 | 2.4.3 |
| @sveltejs/adapter-nodenpm | 2.0.0 ≤ v < 2.1.2, 3.0.0 ≤ v < 3.0.3, 4.0.0 ≤ v < 4.0.1 | 2.1.2, 3.0.3, 4.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.