CVE Vulnerabilities

CVE-2024-23641

Published: Jan 24, 2024 | Modified: Feb 05, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg {} to a built and previewed/hosted sveltekit app throws Request with GET/HEAD method cannot have body. and crashes the preview/hosting. After this happens, one must manually restart the app. TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. @sveltejs/adapter-node versions 2.1.2, 3.0.3, and 4.0.1 and @sveltejs/kit version 2.4.3 contain a patch for this issue.

Affected Software

Name Vendor Start Version End Version
Adapter-node Svelte 2.0.0 (including) 2.1.2 (excluding)
Adapter-node Svelte 3.0.0 (including) 3.0.3 (excluding)
Adapter-node Svelte 4.0.0 (including) 4.0.0 (including)
Kit Svelte 2.0.0 (including) 2.4.3 (excluding)

References