CVE-2024-23641

Published Jan 24, 2024

Last updated 9 months ago

Overview

Description: SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.
Source: security-advisories@github.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
security-advisories@github.com: CWE-20

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:svelte:adapter-node:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "209634B7-FE22-4485-9028-260DB48686B8",
            "versionEndExcluding": "2.1.2",
            "versionStartIncluding": "2.0.0"
          },
          {
            "criteria": "cpe:2.3:a:svelte:adapter-node:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "14D47D99-43E6-4E15-A6D8-9E834635EA9F",
            "versionEndExcluding": "3.0.3",
            "versionStartIncluding": "3.0.0"
          },
          {
            "criteria": "cpe:2.3:a:svelte:adapter-node:4.0.0:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BD037ACA-67C2-4005-A9F6-B13D67578493"
          },
          {
            "criteria": "cpe:2.3:a:svelte:kit:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "849FCB2F-C3D7-4377-8D03-2B7F60077BED",
            "versionEndExcluding": "2.4.3",
            "versionStartIncluding": "2.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References