Packages / @sveltejs/kit / Security

HighVulnerabilityGHSA-g5m6-hxpp-fc49CVE-2024-23641Published 24 Jan 2024

Sending a GET or HEAD request with a body crashes SvelteKit

Affected releases · @sveltejs/kit

  • 2.x2.0.0 – 2.4.2Fixed in 2.4.3

On 2.x, the newest line:

npm install @sveltejs/kit@2.4.3
3.x

  1. Not affected

    3.0.0 – 3.1.0

    3 releases, latest

2.x

  1. Affected

    2.0.0 – 2.4.2

    24 releases

  2. Fixed

    2.4.3 – 2.70.3

    213 releases

389 stable releases of @sveltejs/kit, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @sveltejs/kit. It is read in your browser and sent nowhere.

What happens

Summary

In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD method cannot have body. and crashes the app.

node:internal/deps/undici/undici:6066
          throw new TypeError("Request with GET/HEAD method cannot have body.");
                ^

TypeError: Request with GET/HEAD method cannot have body.
    at new Request (node:internal/deps/undici/undici:6066:17)
    at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/node/index.js:107:9)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:181:26
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:172:6
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:211:27
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)

Node.js v20.11.0

TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.

PoC

First do a fresh install of SvelteKit 2 with the example app. Typescript.

  1. npm run build

  2. npm run preview

  3. Go to localhost (works)

  4. curl -X GET -d "{}" localhost/bye

  5. Application crashes and localhost is down

Impact

Denial of Service for apps using adapter-node