---
id: CVE-2024-23641
aliases:
  - GHSA-g5m6-hxpp-fc49
title: Sending a GET or HEAD request with a body crashes SvelteKit
summary: Sending a GET or HEAD request with a body crashes SvelteKit
severity: high
cvss: 7.5
cwe:
  - CWE-20
vendor: sveltejs
product: '@sveltejs/kit'
ecosystem: npm
affected:
  - '@sveltejs/kit >= 2.0.0, < 2.4.3'
  - '@sveltejs/adapter-node >= 2.0.0, < 2.1.2'
  - '@sveltejs/adapter-node >= 3.0.0, < 3.0.3'
  - '@sveltejs/adapter-node = 4.0.0'
patched:
  - '@sveltejs/kit 2.4.3'
  - '@sveltejs/adapter-node 2.1.2'
  - '@sveltejs/adapter-node 3.0.3'
  - '@sveltejs/adapter-node 4.0.1'
published: '2024-01-24'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T14:58:25Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-g5m6-hxpp-fc49'
references:
  - url: 'https://github.com/sveltejs/kit/security/advisories/GHSA-g5m6-hxpp-fc49'
  - url: >-
      https://github.com/sveltejs/kit/commit/af34142631c876a7eb62ff81f71e8a3f90dafee9
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-23641'
  - url: 'https://github.com/advisories/GHSA-g5m6-hxpp-fc49'
tags:
  - ghsa
  - npm
epss: 0.00764
epssPercentile: 0.5462
ingestedAt: '2026-10-18T15:45:12.224Z'
---

## Overview

### Summary
In SvelteKit 2 sending a GET request with a body eg `{}` to a SvelteKit app in preview or with `adapter-node` throws `Request with GET/HEAD method cannot have body.` and crashes the app.

```
node:internal/deps/undici/undici:6066
          throw new TypeError("Request with GET/HEAD method cannot have body.");
                ^

TypeError: Request with GET/HEAD method cannot have body.
    at new Request (node:internal/deps/undici/undici:6066:17)
    at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/node/index.js:107:9)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:181:26
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:172:6
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:211:27
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)

Node.js v20.11.0
```

`TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.

<!--
### Details
_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._
-->
### PoC
<!-- _Complete instructions, including specific configuration details, to reproduce the vulnerability._ -->
First do a fresh install of SvelteKit 2 with the example app. Typescript.

1. `npm run build`
2. `npm run preview`
3. Go to http://localhost:4173 (works)
4. curl -X GET -d "{}" http://localhost:4173/bye
5. Application crashes and http://localhost:4173 is down

### Impact
<!-- _What kind of vulnerability is it? Who is impacted?_ -->
Denial of Service for apps using `adapter-node`

## Affected packages

- `@sveltejs/kit >= 2.0.0, < 2.4.3`
- `@sveltejs/adapter-node >= 2.0.0, < 2.1.2`
- `@sveltejs/adapter-node >= 3.0.0, < 3.0.3`
- `@sveltejs/adapter-node = 4.0.0`

## Remediation

Upgrade to a patched release:

- `@sveltejs/kit 2.4.3`
- `@sveltejs/adapter-node 2.1.2`
- `@sveltejs/adapter-node 3.0.3`
- `@sveltejs/adapter-node 4.0.1`