CVE-2024-23641

2024-01-2417:15:08

CWE-20

[email protected]

web.nvd.nist.gov

sveltekit

get request

@sveltejs/adapter-node

web development kit

request crash

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

17.0%

JSON

SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg {} to a built and previewed/hosted sveltekit app throws Request with GET/HEAD method cannot have body. and crashes the preview/hosting. After this happens, one must manually restart the app. TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. @sveltejs/adapter-node versions 2.1.2, 3.0.3, and 4.0.1 and @sveltejs/kit version 2.4.3 contain a patch for this issue.

Affected configurations

Nvd

Node

svelteadapter-nodeRange2.0.0–2.1.2node.js

svelteadapter-nodeRange3.0.0–3.0.3node.js

svelteadapter-nodeMatch4.0.0node.js

sveltekitRange2.0.0–2.4.3node.js

VendorProductVersionCPE
svelteadapter-node*cpe:2.3:a:svelte:adapter-node:*:*:*:*:*:node.js:*:*
svelteadapter-node4.0.0cpe:2.3:a:svelte:adapter-node:4.0.0:*:*:*:*:node.js:*:*
sveltekit*cpe:2.3:a:svelte:kit:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
svelte	adapter-node	*	cpe:2.3:a:svelte:adapter-node::::::node.js::*
svelte	adapter-node	4.0.0	cpe:2.3:a:svelte:adapter-node:4.0.0:::::node.js::
svelte	kit	*	cpe:2.3:a:svelte:kit::::::node.js::*