Svelte CVE-2026-42567
MEDIUM
GHSA-9rmh-mm8f-r9h6
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 npm packages depend on svelte (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 5.51.5.
DescriptionNVD
An internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to svelte:element, you are safe.
AnalysisAI
Regular expression denial of service (ReDoS) in Svelte 5.51.5 through 5.55.6 allows attackers to cause application hang or crash by passing unconstrained-length tag names to the <svelte:element> component, triggering exponential regex evaluation time in the runtime tag validation logic. The vulnerability requires applications to accept user-controlled tag input without length or content restrictions.
Sign in for full analysis, threat intelligence, and remediation guidance.
Share
External POC / Exploit Code
Leaving vuln.today