CVE-2024-23641: Sending a GET or HEAD request with a body crashes SvelteKit
Summary In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD method cannot have body. and crashes the app.
node:internal/deps/undici/undici:6066 throw new TypeError("Request with GET/HEAD method cannot have body."); ^
TypeError: Request with GET/HEAD method cannot have body. at new Request (node:internal/deps/undici/undici:6066:17) at getRequest (file:///C:/Users/admin/Desktop/reproduction/nodemodules/@sveltejs/kit/src/exports/node/index.js:107:9) at file:///C:/Users/admin/Desktop/reproduction/nodemodules/@sveltejs/kit/src/exports/vite/preview/index.js:181:26 at call (file:///C:/Users/admin/Desktop/reproduction/nodemodules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7) at next (file:///C:/Users/admin/Desktop/reproduction/nodemodules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5) at file:///C:/Users/admin/Desktop/reproduction/nodemodules/@sveltejs/kit/src/exports/vite/preview/index.js:172:6 at call (file:///C:/Users/admin/Desktop/reproduction/nodemodules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7) at next (file:///C:/Users/admin/Desktop/reproduction/nodemodules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5) at file:///C:/Users/admin/Desktop/reproduction/nodemodules/@sveltejs/kit/src/exports/vite/preview/index.js:211:27 at call (file:///C:/Users/admin/Desktop/reproduction/nodemodules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
Node.js v20.11.0
TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.
<!-- Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. --> PoC <!-- Complete instructions, including specific configuration details, to reproduce the vulnerability. --> First do a fresh install of SvelteKit 2 with the example app. Typescript.
1. npm run build 2. npm run preview 3. Go to http://localhost:4173 (works) 4. curl -X GET -d "{}" http://localhost:4173/bye 5. Application crashes and http://localhost:4173 is down
Impact <!-- What kind of vulnerability is it? Who is impacted? --> Denial of Service for apps using adapter-node
Other sources
SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg {} to a built and previewed/hosted sveltekit app throws Request with GET/HEAD method cannot have body. and crashes the preview/hosting. After this happens, one must manually restart the app. TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. @sveltejs/adapter-node versions 2.1.2, 3.0.3, and 4.0.1 and @sveltejs/kit version 2.4.3 contain a patch for this issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@sveltejs/adapter-nodeto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
npm/@sveltejs/adapter-nodeto a version that resolves this vulnerability.Fixed in 3.0.3 - Upgrade
Upgrade
npm/@sveltejs/adapter-nodeto a version that resolves this vulnerability.Fixed in 2.1.2 - Upgrade
Upgrade
npm/@sveltejs/kitto a version that resolves this vulnerability.Fixed in 2.4.3 - Upgrade
Upgrade
@sveltejs/adapter-nodeto a version that resolves this vulnerability.Fixed in 2.1.2 - Upgrade
Upgrade
@sveltejs/adapter-nodeto a version that resolves this vulnerability.Fixed in 3.0.3 - Upgrade
Upgrade
@sveltejs/adapter-nodeto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
@sveltejs/kitto a version that resolves this vulnerability.Fixed in 2.4.3 - Compensating control
Ensure upstream/proxy/WAF rules block malformed or body-carrying requests, specifically GET/HEAD requests with a request body and TRACE requests, since these crash SvelteKit apps using adapter-node.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23641?
CVE-2024-23641 is considered a critical vulnerability as it leads to application crashes when a GET request with a body is made.
How do I fix CVE-2024-23641?
To fix CVE-2024-23641, upgrade to version 4.0.1 of @sveltejs/adapter-node or 2.4.3 of @sveltejs/kit.
Which software is affected by CVE-2024-23641?
CVE-2024-23641 affects versions of @sveltejs/adapter-node up to 4.0.0, and prior versions including 3.0.3 and 2.1.2.
What type of issue does CVE-2024-23641 represent?
CVE-2024-23641 represents a flaw in how SvelteKit apps handle GET requests with a body, causing crashes.
Is there a workaround for CVE-2024-23641?
Currently, the recommended approach for CVE-2024-23641 is to avoid including a body in GET requests.