Sending a GET or HEAD request with a body crashes SvelteKit

Description

In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD method cannot have body. and crashes the app.

TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.

<!–

Recommendation

Update the @sveltejs/kit package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.0, < 2.4.3
• Patched version(s): 2.4.3

References

• GHSA-g5m6-hxpp-fc49
• CVE-2024-23641
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Prebid-universal-creative latest on npm briefly compromised - CVE-2025-59039
• JS Html Sanitizer allows XSS when used with contentEditable - CVE-2025-29771
• Potential XSS vulnerability in jQuery (GHSA-gxr4-xjj5-5px2) - CVE-2020-11022
• @sveltejs/kit vulnerable to XSS on dev mode 404 page - CVE-2024-53261

Tags:

npm

@sveltejs/kit