Vulnerability record · CVE-2024-23641 · published 24 January 2024

CVE-2024-23641: Svelte adapter-node improper input validation vulnerability

Svelte · Adapter Node

SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.

7.5 CVSS 3.1 High EPSS 0.76% · top 46.4% CWE-20 · Improper input validation

7.5CVSS 3.1 base score

0.76%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

4References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Adapter Node Svelte

Kit Svelte

References

Link	Tags
https://github.com/sveltejs/kit/commit/af34142631c876a7eb62ff81f71e8a3f90dafee9	Patch
https://github.com/sveltejs/kit/security/advisories/GHSA-g5m6-hxpp-fc49	ExploitVendor Advisory
https://github.com/sveltejs/kit/commit/af34142631c876a7eb62ff81f71e8a3f90dafee9	Patch
https://github.com/sveltejs/kit/security/advisories/GHSA-g5m6-hxpp-fc49	ExploitVendor Advisory

Track CVE-2024-23641 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.4CVE-2025-67647Svelte adapter-node server-side request forgery (ssrf) vulnerabilitySvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a serve…EPSS 0.53%15 Jan 2026 8.2CVE-2026-40073Svelte kit allocation without limits vulnerabilitySvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, reque…EPSS 0.96%10 Apr 2026 8.2CVE-2026-22803Svelte kit allocation without limits vulnerabilitySvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote…EPSS 0.60%15 Jan 2026 6.3CVE-2026-40074Svelte kit vulnerabilitySvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside …EPSS 0.61%10 Apr 2026 9.5CVE-2026-88771Citrix NetScaler Improper Input Validation VulnerabilityImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-…KEV27 Sep 2026 9.5CVE-2026-93952Arista velocloud orchestrator improper input validation vulnerabilityVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality an…KEVEPSS 0.90%22 Sep 2026 8.8CVE-2019-1068Microsoft SQL Server improper input validation remote code executionMicrosoft SQL Server mishandles processing of internal functions, allowing an authenticated remote attacker to execute code on the database server. T…KEVEPSS 58%analysed15 Jul 2019 5.9CVE-2025-68686FortiOS symbolic link patch bypass exposes sensitive informationFortiOS contains an information exposure flaw (CWE-200) that lets a remote unauthenticated attacker bypass the patch for the symbolic link persistenc…KEVEPSS 30%analysed10 Feb 2026

Source: NIST National Vulnerability Database (record CVE-2024-23641), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.