VDB
Sign up
HIGH7.5

GHSA-g5m6-hxpp-fc49

Sending a GET or HEAD request with a body crashes SvelteKit

Quick fix

GHSA-g5m6-hxpp-fc49 — @sveltejs/kit: upgrade to the fixed version with the command below.

npm install @sveltejs/kit@2.4.3

Details

### Summary In SvelteKit 2 sending a GET request with a body eg `{}` to a SvelteKit app in preview or with `adapter-node` throws `Request with GET/HEAD method cannot have body.` and crashes the app.

``` node:internal/deps/undici/undici:6066 throw new TypeError("Request with GET/HEAD method cannot have body."); ^

TypeError: Request with GET/HEAD method cannot have body. at new Request (node:internal/deps/undici/undici:6066:17) at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/node/index.js:107:9) at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:181:26 at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7) at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5) at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:172:6 at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7) at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5) at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:211:27 at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)

Node.js v20.11.0 ```

`TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.

<!-- ### Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ --> ### PoC <!-- _Complete instructions, including specific configuration details, to reproduce the vulnerability._ --> First do a fresh install of SvelteKit 2 with the example app. Typescript.

1. `npm run build` 2. `npm run preview` 3. Go to http://localhost:4173 (works) 4. curl -X GET -d "{}" http://localhost:4173/bye 5. Application crashes and http://localhost:4173 is down

### Impact <!-- _What kind of vulnerability is it? Who is impacted?_ --> Denial of Service for apps using `adapter-node`

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@sveltejs/kit
Introduced in: 2.0.0Fixed in: 2.4.3
Fixnpm install @sveltejs/kit@2.4.3
npm/@sveltejs/adapter-node
Introduced in: 2.0.0Fixed in: 2.1.2
Fixnpm install @sveltejs/adapter-node@2.1.2
npm/@sveltejs/adapter-node
Introduced in: 3.0.0Fixed in: 3.0.3
Fixnpm install @sveltejs/adapter-node@3.0.3
npm/@sveltejs/adapter-node
Introduced in: 4.0.0Fixed in: 4.0.1
Fixnpm install @sveltejs/adapter-node@4.0.1

References