MEDIUM

GHSA-9rmh-mm8f-r9h6

Svelte: ReDoS in `<svelte:element>` Tag Validation

Quick fix

GHSA-9rmh-mm8f-r9h6 — svelte: upgrade to the fixed version with the command below.

npm install svelte@5.55.7

Details

An internal regex in the Svelte runtime can take exponential time to test in `<svelte:element this={tag}></svelte:element>`. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to `svelte:element`, you are safe.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/svelte

Introduced in: 5.51.5Fixed in: 5.55.7

Fixnpm install svelte@5.55.7

References

https://github.com/sveltejs/svelte/security/advisories/GHSA-9rmh-mm8f-r9h6[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-42567[ADVISORY]
https://github.com/sveltejs/svelte[PACKAGE]
https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7[WEB]