GHSA-9rmh-mm8f-r9h6

Svelte: ReDoS in `<svelte:element>` Tag Validation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-42567

Packages

Ecosystem	Package	Affected	Fixed in
npm	svelte	>= 5.51.5, < 5.55.7	5.55.7

Details

As written in the advisory (Markdown source, shown as plain text).

An internal regex in the Svelte runtime can take exponential time to test in `<svelte:element this={tag}></svelte:element>`. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to `svelte:element`, you are safe.

References

External links from the advisory. They lead to third-party sites.

https://github.com/sveltejs/svelte/security/advisories/GHSA-9rmh-mm8f-r9h6 web
https://nvd.nist.gov/vuln/detail/CVE-2026-42567 advisory
https://github.com/sveltejs/svelte package
https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7 web