CVE-2024-23641

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-23641

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23641.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-23641

Aliases

GHSA-g5m6-hxpp-fc49

Published

2024-01-24T16:56:32.392Z

Modified

2026-07-15T01:49:16.454895418Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Sending a GET or HEAD request with a body crashes SvelteKit

Details

SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg {} to a built and previewed/hosted sveltekit app throws Request with GET/HEAD method cannot have body. and crashes the preview/hosting. After this happens, one must manually restart the app. TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. @sveltejs/adapter-node versions 2.1.2, 3.0.3, and 4.0.1 and @sveltejs/kit version 2.4.3 contain a patch for this issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23641.json",
    "cwe_ids": [
        "CWE-20"
    ]
}

References

Affected packages

Git / github.com/sveltejs/kit

Affected ranges

Type

GIT

Repo

https://github.com/sveltejs/kit

Events

Introduced

2ab20205163f303de3c850c2b618259440aabddd

Fixed

1dd68bde291b7f9da65803c1810c444b8a0a8390

Fixed

40e85888d7cf53fb4c92bdca9efaa79c1fe5c682

Fixed

a93e19b0022491e7979a5b36f2275ac0e1f927f8

Introduced

ee898a9d90c89149d96f05e749cdd3839f79d95a

Fixed

af34142631c876a7eb62ff81f71e8a3f90dafee9

Database specific

{
    "cpe": [
        "cpe:2.3:a:svelte:adapter-node:*:*:*:*:*:node.js:*:*",
        "cpe:2.3:a:svelte:kit:*:*:*:*:*:node.js:*:*",
        "cpe:2.3:a:svelte:adapter-node:4.0.0:*:*:*:*:node.js:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.1.2"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.3"
        },
        {
            "fixed": "2.4.3"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.0.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

4.*

4.0.0

= 4.*

= 4.0.0

@sveltejs/adapter-auto@2.*

@sveltejs/adapter-auto@2.1.0

@sveltejs/adapter-auto@2.1.1

@sveltejs/adapter-auto@3.*

@sveltejs/adapter-auto@3.0.0

@sveltejs/adapter-auto@3.0.1

@sveltejs/adapter-auto@3.1.0

@sveltejs/adapter-auto@3.1.1

@sveltejs/adapter-cloudflare-workers@1.*

@sveltejs/adapter-cloudflare-workers@1.1.1

@sveltejs/adapter-cloudflare-workers@1.1.2

@sveltejs/adapter-cloudflare-workers@1.1.3

@sveltejs/adapter-cloudflare-workers@1.1.4

@sveltejs/adapter-cloudflare-workers@1.2.0

@sveltejs/adapter-cloudflare-workers@1.2.1

@sveltejs/adapter-cloudflare-workers@1.2.2

@sveltejs/adapter-cloudflare-workers@1.2.3

@sveltejs/adapter-cloudflare-workers@2.*

@sveltejs/adapter-cloudflare-workers@2.0.0

@sveltejs/adapter-cloudflare-workers@2.0.1

@sveltejs/adapter-cloudflare-workers@2.0.2

@sveltejs/adapter-cloudflare-workers@2.0.3

@sveltejs/adapter-cloudflare-workers@2.1.0

@sveltejs/adapter-cloudflare@2.*

@sveltejs/adapter-cloudflare@2.2.1

@sveltejs/adapter-cloudflare@2.2.2

@sveltejs/adapter-cloudflare@2.2.3

@sveltejs/adapter-cloudflare@2.2.4

@sveltejs/adapter-cloudflare@2.3.0

@sveltejs/adapter-cloudflare@2.3.1

@sveltejs/adapter-cloudflare@2.3.2

@sveltejs/adapter-cloudflare@2.3.3

@sveltejs/adapter-cloudflare@2.3.4

@sveltejs/adapter-cloudflare@3.*

@sveltejs/adapter-cloudflare@3.0.0

@sveltejs/adapter-cloudflare@3.0.1

@sveltejs/adapter-cloudflare@3.0.2

@sveltejs/adapter-cloudflare@4.*

@sveltejs/adapter-cloudflare@4.0.0

@sveltejs/adapter-cloudflare@4.0.1

@sveltejs/adapter-cloudflare@4.0.2

@sveltejs/adapter-cloudflare@4.1.0

@sveltejs/adapter-netlify@2.*

@sveltejs/adapter-netlify@2.0.5

@sveltejs/adapter-netlify@2.0.7

@sveltejs/adapter-netlify@2.0.8

@sveltejs/adapter-netlify@3.*

@sveltejs/adapter-netlify@3.0.0

@sveltejs/adapter-netlify@3.0.1

@sveltejs/adapter-netlify@3.0.2

@sveltejs/adapter-netlify@4.*

@sveltejs/adapter-netlify@4.0.0

@sveltejs/adapter-netlify@4.1.0

@sveltejs/adapter-node@1.*

@sveltejs/adapter-node@1.2.4

@sveltejs/adapter-node@1.3.0

@sveltejs/adapter-node@1.3.1

@sveltejs/adapter-node@2.*

@sveltejs/adapter-node@2.0.0

@sveltejs/adapter-node@2.0.1

@sveltejs/adapter-node@2.0.2

@sveltejs/adapter-node@2.1.0

@sveltejs/adapter-node@2.1.1

@sveltejs/adapter-node@3.*

@sveltejs/adapter-node@3.0.0

@sveltejs/adapter-node@3.0.1

@sveltejs/adapter-node@4.*

@sveltejs/adapter-node@4.0.0

@sveltejs/adapter-static@2.*

@sveltejs/adapter-static@2.0.3

@sveltejs/adapter-static@3.*

@sveltejs/adapter-static@3.0.0

@sveltejs/adapter-static@3.0.1

@sveltejs/adapter-vercel@2.*

@sveltejs/adapter-vercel@2.0.3

@sveltejs/adapter-vercel@2.0.4

@sveltejs/adapter-vercel@2.1.0

@sveltejs/adapter-vercel@2.4.3

@sveltejs/adapter-vercel@3.*

@sveltejs/adapter-vercel@3.0.0

@sveltejs/adapter-vercel@3.0.1

@sveltejs/adapter-vercel@3.0.2

@sveltejs/adapter-vercel@3.0.3

@sveltejs/adapter-vercel@3.1.0

@sveltejs/adapter-vercel@4.*

@sveltejs/adapter-vercel@4.0.0

@sveltejs/adapter-vercel@4.0.1

@sveltejs/adapter-vercel@4.0.2

@sveltejs/adapter-vercel@4.0.3

@sveltejs/adapter-vercel@4.0.4

@sveltejs/adapter-vercel@4.0.5

@sveltejs/adapter-vercel@5.*

@sveltejs/adapter-vercel@5.0.0

@sveltejs/adapter-vercel@5.1.0

@sveltejs/amp@1.*

@sveltejs/amp@1.1.0

@sveltejs/enhanced-img@0.*

@sveltejs/enhanced-img@0.1.1

@sveltejs/enhanced-img@0.1.2

@sveltejs/enhanced-img@0.1.3

@sveltejs/enhanced-img@0.1.4

@sveltejs/enhanced-img@0.1.5

@sveltejs/enhanced-img@0.1.6

@sveltejs/enhanced-img@0.1.7

@sveltejs/enhanced-img@0.1.8

@sveltejs/kit@1.*

@sveltejs/kit@1.15.10

@sveltejs/kit@1.15.11

@sveltejs/kit@1.15.9

@sveltejs/kit@1.16.0

@sveltejs/kit@1.16.1

@sveltejs/kit@1.16.2

@sveltejs/kit@1.16.3

@sveltejs/kit@1.17.0

@sveltejs/kit@1.17.1

@sveltejs/kit@1.18.0

@sveltejs/kit@1.19.0

@sveltejs/kit@1.20.0

@sveltejs/kit@1.20.1

@sveltejs/kit@1.20.2

@sveltejs/kit@1.20.3

@sveltejs/kit@1.20.5

@sveltejs/kit@1.21.0

@sveltejs/kit@1.22.0

@sveltejs/kit@1.22.1

@sveltejs/kit@1.22.2

@sveltejs/kit@1.22.3

@sveltejs/kit@1.22.4

@sveltejs/kit@1.22.5

@sveltejs/kit@1.22.6

@sveltejs/kit@1.23.0

@sveltejs/kit@1.23.1

@sveltejs/kit@1.24.0

@sveltejs/kit@1.24.1

@sveltejs/kit@1.25.0

@sveltejs/kit@1.25.1

@sveltejs/kit@1.25.2

@sveltejs/kit@1.26.0

@sveltejs/kit@1.27.0

@sveltejs/kit@1.27.1

@sveltejs/kit@1.27.2

@sveltejs/kit@1.27.3

@sveltejs/kit@1.27.4

@sveltejs/kit@1.27.5

@sveltejs/kit@1.27.6

@sveltejs/kit@1.27.7

@sveltejs/kit@1.28.0

@sveltejs/kit@1.29.0

@sveltejs/kit@1.29.1

@sveltejs/kit@1.30.0

@sveltejs/kit@1.30.1

@sveltejs/kit@1.30.2

@sveltejs/kit@1.30.3

@sveltejs/kit@1.7.1

@sveltejs/kit@1.7.2

@sveltejs/kit@1.8.0

@sveltejs/kit@1.8.1

@sveltejs/kit@1.8.2

@sveltejs/kit@1.8.3

@sveltejs/kit@2.*

@sveltejs/kit@2.0.0

@sveltejs/kit@2.0.1

@sveltejs/kit@2.0.2

@sveltejs/kit@2.0.3

@sveltejs/kit@2.0.4

@sveltejs/kit@2.0.5

@sveltejs/kit@2.0.6

@sveltejs/kit@2.0.7

@sveltejs/kit@2.0.8

@sveltejs/kit@2.1.0

@sveltejs/kit@2.1.1

@sveltejs/kit@2.1.2

@sveltejs/kit@2.2.0

@sveltejs/kit@2.2.1

@sveltejs/kit@2.2.2

@sveltejs/kit@2.3.0

@sveltejs/kit@2.3.1

@sveltejs/kit@2.3.2

@sveltejs/kit@2.3.3

@sveltejs/kit@2.3.4

@sveltejs/kit@2.3.5

@sveltejs/kit@2.4.0

@sveltejs/kit@2.4.1

@sveltejs/kit@2.4.2

@sveltejs/package@2.*

@sveltejs/package@2.0.0

@sveltejs/package@2.0.1

@sveltejs/package@2.0.2

@sveltejs/package@2.1.0

@sveltejs/package@2.2.0

@sveltejs/package@2.2.1

@sveltejs/package@2.2.2

@sveltejs/package@2.2.3

@sveltejs/package@2.2.4

@sveltejs/package@2.2.5

@sveltejs/package@2.2.6

create-svelte@3.*

create-svelte@3.0.0

create-svelte@3.0.1

create-svelte@3.0.2

create-svelte@4.*

create-svelte@4.0.0

create-svelte@4.1.0

create-svelte@4.1.1

create-svelte@4.2.0

create-svelte@5.*

create-svelte@5.0.0

create-svelte@5.0.1

create-svelte@5.0.2

create-svelte@5.0.3

create-svelte@5.0.4

create-svelte@5.0.5

create-svelte@5.0.6

create-svelte@5.1.0

create-svelte@5.1.1

create-svelte@5.2.0

create-svelte@5.3.0

create-svelte@5.3.1

create-svelte@5.3.2

create-svelte@5.3.3

create-svelte@5.3.4

create-svelte@6.*

create-svelte@6.0.0

create-svelte@6.0.1

create-svelte@6.0.2

create-svelte@6.0.3

create-svelte@6.0.4

create-svelte@6.0.5

create-svelte@6.0.6

create-svelte@6.0.7

create-svelte@6.0.8

svelte-migrate@1.*

svelte-migrate@1.1.0

svelte-migrate@1.1.1

svelte-migrate@1.1.2

svelte-migrate@1.1.3

svelte-migrate@1.2.0

svelte-migrate@1.2.1

svelte-migrate@1.2.2

svelte-migrate@1.2.3

svelte-migrate@1.2.4

svelte-migrate@1.2.5

svelte-migrate@1.2.6

svelte-migrate@1.2.7

svelte-migrate@1.2.8

svelte-migrate@1.3.0

svelte-migrate@1.3.1

svelte-migrate@1.3.2

svelte-migrate@1.3.3

svelte-migrate@1.3.4

svelte-migrate@1.3.5

svelte-migrate@1.3.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23641.json"