CVE-2024-23641 Sending a GET or HEAD request with a body crashes SvelteKit

2024-01-2416:56:32

CWE-20

GitHub_M

www.cve.org

cve-2024-23641

sveltekit

get request

head request

@sveltejs/adapter-node

@sveltejs/kit

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.0005 Low

EPSS

Percentile

17.1%

JSON

SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg {} to a built and previewed/hosted sveltekit app throws Request with GET/HEAD method cannot have body. and crashes the preview/hosting. After this happens, one must manually restart the app. TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. @sveltejs/adapter-node versions 2.1.2, 3.0.3, and 4.0.1 and @sveltejs/kit version 2.4.3 contain a patch for this issue.

CNA Affected

[
  {
    "vendor": "sveltejs",
    "product": "kit",
    "versions": [
      {
        "version": ">= 2.0.0, < 2.4.3",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.1.2",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0, < 3.0.3",
        "status": "affected"
      },
      {
        "version": "= 4.0.0",
        "status": "affected"
      }
    ]
  }
]