# CVE-2024-23641: Sending a GET or HEAD request with a body crashes SvelteKit

Source: https://junglewise.ai/threats/cve-2024-23641-sveltekit-denial-of-service-via-get-head-requests-with-body  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-23641 · Severity: high · CVSS 7.5 · Published 2024-01-24

SvelteKit is a popular JavaScript framework for building web applications. An attacker can crash a SvelteKit application by sending a GET or HEAD HTTP request with a message body, causing the application to become unavailable and disrupting service to all users.

Technologies: [@sveltejs/kit (npm)](https://junglewise.ai/threats/technologies/sveltejs-kit), [SvelteKit](https://junglewise.ai/threats/technologies/sveltekit). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Svelte](https://junglewise.ai/threats/vendors/svelte).

## Quick answers

**Is CVE-2024-23641 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-23641 being exploited in the wild.

**How severe is CVE-2024-23641?** High severity, with a CVSS score of 7.5, published 24 January 2024.

**Which products and versions are affected?** @sveltejs/adapter-node (npm) >= 2.0.0, < 2.1.2; @sveltejs/kit (npm) >= 2.0.0, < 2.4.3; Svelte Adapter-Node 4.0.0; SvelteKit 2.0.0 to 2.4.2.

**Is there a fix for CVE-2024-23641?** A patch was published on 2024-01-24: SvelteKit 2.4.3, adapter-node 2.1.2, 3.0.3, 4.0.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-23641 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-23641?** Check whether you run @sveltejs/adapter-node (npm), @sveltejs/kit (npm), Svelte Adapter-Node or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper input validation flaw in SvelteKit 2 and related adapter-node packages. When the framework processes an HTTP GET or HEAD request containing a message body, it fails to strip or ignore the body before constructing a Web Request object, which throws a TypeError because the Web Request specification disallows bodies on GET/HEAD requests. The crash occurs in both the preview server and production deployments using adapter-node. No authentication or user interaction is required; any network-accessible SvelteKit application is exploitable. An attacker can trigger repeated crashes via simple curl commands, causing persistent denial of service. Patches are available: SvelteKit 2.4.3+, adapter-node 2.1.2+, 3.0.3+, or 4.0.1+.

## Affected products

- Svelte SvelteKit 2.0.0 to 2.4.2
- Svelte adapter-node 2.0.0 to 2.1.1
- Svelte adapter-node 3.0.0 to 3.0.2
- Svelte adapter-node 4.0.0

## Identifiers

- CVE-2024-23641
- GHSA-g5m6-hxpp-fc49

## Timeline

- 2024-01-24: disclosed
- 2024-01-24: patched: SvelteKit 2.4.3, adapter-node 2.1.2, 3.0.3, 4.0.1 released

## References

- [https://github.com/sveltejs/kit/security/advisories/GHSA-g5m6-hxpp-fc49](https://github.com/sveltejs/kit/security/advisories/GHSA-g5m6-hxpp-fc49)

## Related threats

- [SvelteKit XSS via cache-control header in prerendered pages](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-xss-via-cache-control-header-5731f4e1)
- [SvelteKit open redirect in enhanced form actions](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-open-redirect-via-enhanced-9a8dcd94)
- [SvelteKit path traversal in vite preview server on Windows](https://junglewise.ai/threats/cve-2026-114063-sveltekit-sveltejs-kit-from-2-10-0-before-3-0-0-contains-a-path)
- [SvelteKit server-side request forgery in self-fetch fallbacks](https://junglewise.ai/threats/cve-2026-114062-sveltekit-before-3-0-0-contains-a-server-side-request-forgery)
- [SvelteKit cross-site scripting in prerendered pages](https://junglewise.ai/threats/cve-2026-114061-sveltekit-sveltejs-kit-before-3-0-0-contains-a-cross-site)