High

Sending a GET or HEAD request with a body crashes SvelteKit

Disclosed: 24.01.2024
Updated: 11.10.2026 10:22

Summary

In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD method cannot have body. and crashes the app.

node:internal/deps/undici/undici:6066
          throw new TypeError("Request with GET/HEAD method cannot have body.");
                ^

TypeError: Request with GET/HEAD method cannot have body.
    at new Request (node:internal/deps/undici/undici:6066:17)
    at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/node/index.js:107:9)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:181:26
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:172:6
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@sveltejs/kit/src/exports/vite/preview/index.js:211:27
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)

Node.js v20.11.0

TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.

PoC

First do a fresh install of SvelteKit 2 with the example app. Typescript.

npm run build
npm run preview
Go to http://localhost:4173 (works)
curl -X GET -d "{}" http://localhost:4173/bye
Application crashes and http://localhost:4173 is down

Impact

Denial of Service for apps using adapter-node

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	@sveltejs/adapter-node	>= 2.0.0, < 2.1.2, >= 3.0.0, < 3.0.3, >= 4.0.0, < 4.0.1	2.1.2, 3.0.3, 4.0.1
npm package	@sveltejs/kit	>= 2.0.0, < 2.4.3	2.4.3

References

CVSS score 7.5/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-20
Platform: npm
Package: @sveltejs/adapter-node, @sveltejs/kit
Disclosed: 24.01.2024
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-g5m6-hxpp-fc49 - CC BY 4.0

Vulnerability history: @sveltejs/adapter-node

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 01.2024 01.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 2

Disclosures per year

2024: 1
2025: 0
2026: 1

15.01.2026

SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering

High CVE-2025-67647 >= 5.4.1, < 5.5.1 5.5.1
24.01.2024

Sending a GET or HEAD request with a body crashes SvelteKit this entry

High · 7.5 CVE-2024-23641 >= 2.0.0, < 2.1.2, >= 3.0.0, < 3.0.3, >= 4.0.0, < 4.0.1 2.1.2, 3.0.3, 4.0.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application