GitHub Advisoryadvisory · npm
GHSA-9rmh-mm8f-r9h6 Svelte: ReDoS in `<svelte:element>` Tag Validation
MEDIUM
Official page ↗
- Aliases
- CVE-2026-42567
- Ecosystem
- npm
- Packages
- svelte
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Weaknesses
- CWE-1333
- Reviewed
- 2026-05-14
Affected packages
• npm svelte: >= 5.51.5, < 5.55.7 → fixed in 5.55.7
Description
An internal regex in the Svelte runtime can take exponential time to test in ``. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to `svelte:element`, you are safe.
Related
Alias · CVE (1)
- CVE-2026-42567 Svelte is a performance oriented web framework. vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness