Executive brief
SvelteKit is a popular JavaScript framework for building web applications. An attacker can crash a SvelteKit application by sending a GET or HEAD HTTP request with a message body, causing the application to become unavailable and disrupting service to all users.
Technical details
The vulnerability is an improper input validation flaw in SvelteKit 2 and related adapter-node packages. When the framework processes an HTTP GET or HEAD request containing a message body, it fails to strip or ignore the body before constructing a Web Request object, which throws a TypeError because the Web Request specification disallows bodies on GET/HEAD requests. The crash occurs in both the preview server and production deployments using adapter-node. No authentication or user interaction is required; any network-accessible SvelteKit application is exploitable. An attacker can trigger repeated crashes via simple curl commands, causing persistent denial of service. Patches are available: SvelteKit 2.4.3+, adapter-node 2.1.2+, 3.0.3+, or 4.0.1+.
Affected products
- Svelte SvelteKit 2.0.0 to 2.4.2
- Svelte adapter-node 2.0.0 to 2.1.1
- Svelte adapter-node 3.0.0 to 3.0.2
- Svelte adapter-node 4.0.0
Timeline
- 2024-01-24: disclosed
- 2024-01-24: patched: SvelteKit 2.4.3, adapter-node 2.1.2, 3.0.3, 4.0.1 released