svelte
5.57.2 · 6 Oct 2026MIT4.2M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for svelte. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 5.57.2 | Safe from 5.55.7 | |
| 4.2.20 | 61 open advisories, worst moderate · last release May 2025, no longer updated |
- Highsvelte is vulnerable to XSS with textarea bind:valueGHSA-gw32-9rmw-qwww · 16 Jan 2026
- 3.x3.0.0 – 3.59.1Fixed in 3.59.2
- ModerateSvelte: SSR XSS via Insecure Promise Serialization in hydratableGHSA-f3cj-j4f6-wq85 · 14 May 2026
- 5.x5.46.0 – 5.55.6Fixed in 5.55.7
- ModerateSvelte Vulnerable to XSS via DOM Clobbering of Internal Framework StateGHSA-rcqx-6q8c-2c42 · 14 May 2026
- 5.x5.0.0 – 5.55.6Fixed in 5.55.7
- 4.x and older0.0.1 – 4.2.20No fix, no longer updated · move to 5.55.7
- ModerateSvelte: ReDoS in `<svelte:element>` Tag ValidationGHSA-9rmh-mm8f-r9h6 · 14 May 2026
- 5.x5.51.5 – 5.55.6Fixed in 5.55.7
- ModerateSvelte SSR vulnerable to cross-site scripting via spread attributesGHSA-pr6f-5x2q-rwfp · 14 May 2026
- 5.x5.0.0 – 5.55.6Fixed in 5.55.7
- 4.x and older0.0.1 – 4.2.20No fix, no longer updated · move to 5.55.7
- ModerateSvelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration MarkersGHSA-qgvg-pr8v-6rr3 · 26 Feb 2026
- 5.x5.53.0 – 5.53.4Fixed in 5.53.5
- ModerateSvelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`GHSA-phwv-c562-gvmh · 26 Feb 2026
- 5.x5.0.0 – 5.53.4Fixed in 5.53.5
- 4.x and older0.0.1 – 4.2.20No fix, no longer updated · move to 5.53.5
- ModerateSvelte SSR attribute spreading includes inherited properties from prototype chainGHSA-crpf-4hrx-3jrp · 19 Feb 2026
- 5.x5.0.0 – 5.51.4Fixed in 5.51.5
- 4.x and older0.0.1 – 4.2.20No fix, no longer updated · move to 5.51.5
- ModerateSvelte SSR does not validate dynamic element tag names in `<svelte:element>`GHSA-m56q-vw4c-c2cp · 19 Feb 2026
- 5.x5.0.0 – 5.51.4Fixed in 5.51.5
- 4.x and older0.0.1 – 4.2.20No fix, no longer updated · move to 5.51.5
- ModerateSvelte affected by cross-site scripting via spread attributes in Svelte SSRGHSA-f7gr-6p89-r883 · 19 Feb 2026
- 5.x5.0.0 – 5.51.4Fixed in 5.51.5
- 4.x and older0.0.1 – 4.2.20No fix, no longer updated · move to 5.51.5
- ModerateSvelte affected by XSS in SSR `<option>` elementGHSA-h7h7-mm68-gmrc · 19 Feb 2026
- 5.x5.39.3 – 5.51.4Fixed in 5.51.5
- Moderatesvelte vulnerable to Cross-site ScriptingGHSA-6738-r8g5-qwp3 · 15 Jan 2026
- 5.x5.46.0 – 5.46.3Fixed in 5.46.4
- ModerateSvelte has a potential mXSS vulnerability due to improper HTML escapingGHSA-8266-84wp-wv5c · 30 Aug 2024
- 4.x4.0.0 – 4.2.18Fixed in 4.2.19
- 3.x and older0.0.1 – 3.59.2No fix, no longer updated · move to 4.2.19
- ModerateSvelte vulnerable to XSS when using objects during server-side renderingGHSA-wv8q-r932-8hc7 · 13 Jul 2022
- 3.x3.0.0 – 3.48.0Fixed in 3.49.0
- 2.x and older0.0.1 – 2.16.1No fix, no longer updated · move to 3.49.0
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.