CVE-2024-23641

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jan 24, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-236424.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripti CVE-2024-236434.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripti CVE-2024-236448.1Trillium is a composable toolkit for building internet applications with async rust. In `trillium-http` prior to 0.3.12 and `trillium-client CVE-2024-236456.1GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12.CVE-2024-236468.8Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from availabl CVE-2024-236478.8Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protec CVE-2024-236488.8Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user request CVE-2024-236496.5Lemmy is a link aggregator and forum for the fediverse. Starting in version 0.17.0 and prior to version 0.19.1, users can report private mes CVE-2024-23654.2A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functiona CVE-2024-236505.3BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit CVE-2024-236517.4BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build s CVE-2024-236529.1BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit