CVE-2026-42567
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Jun 9, 2026
CISA due date
—
The record
Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | svelte | 5.51.5 | 5.55.7 |
Related vulnerabilities
- GHSA-9rmh-mm8f-r9h6 Svelte: ReDoS in `` Tag Validation Same vulnerability
- CVE-2026-42599 Svelte is a performance oriented web framework. Also affects svelte
- CVE-2026-42573 Svelte is a performance oriented web framework. Also affects svelte
- GHSA-f3cj-j4f6-wq85 Svelte: SSR XSS via Insecure Promise Serialization in hydratable Also affects svelte
- GHSA-rcqx-6q8c-2c42 Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State Also affects svelte
- GHSA-pr6f-5x2q-rwfp Svelte SSR vulnerable to cross-site scripting via spread attributes Also affects svelte
- GHSA-qgvg-pr8v-6rr3 Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers Also affects svelte
- GHSA-phwv-c562-gvmh Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and… Also affects svelte