Packages / svelte / Security

ModerateVulnerabilityGHSA-9rmh-mm8f-r9h6CVE-2026-42567Published 14 May 2026

Svelte: ReDoS in `<svelte:element>` Tag Validation

Affected releases · svelte

  • 5.x5.51.5 – 5.55.6Fixed in 5.55.7

On 5.x, the newest line:

npm install svelte@5.55.7

  1. Not affected

    0.0.1 – 5.51.4

    725 releases

  2. Affected

    5.51.5 – 5.55.6

    25 releases

  3. Fixed

    5.55.7 – 5.57.2

    18 releases, latest

768 stable releases of svelte, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for svelte. It is read in your browser and sent nowhere.

What happens

An internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to svelte:element, you are safe.