Aller au contenu
en Se connecter
7.5 Élevée

CVE-2024-23641 SvelteKit is a web development kit

Description

SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
kit 4.0.0 Pas de correctif indiqué
kit 3.0 3.0.0 → < 3.0.3 3.0.3
kit 2.0 2.0.0 → < 2.4.3 2.4.3

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de kit

Les 22 CVE de kit →
CVE-2026-114063 SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on… 8.7 Élevée CVE-2026-114062 SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach… 6.9 Moyenne CVE-2026-114061 SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a… 2.3 Faible CVE-2026-114060 SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on… 2.1 Faible
Suivre cette CVE