CVE-2026-42567: Svelte Exponential ReDoS Vulnerability in `<svelte:element>` Tag Validation
Summary
CVE-2026-42567: Svelte: ReDoS in Tag Validation. Affects svelte versions >= 5.51.5, < 5.55.7. Fixed in 5.55.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Svelte is a modern JavaScript framework that allows developers to build user interfaces with a focus on performance and simplicity. It compiles components into highly efficient JavaScript code, enabling reactive programming without the overhead of a virtual DOM. However, a vulnerability has been identified in the <svelte:element> tag validation, which can lead to performance issues if not managed properly.
Vulnerability Detail
The vulnerability arises from an internal regular expression (regex) used in the Svelte runtime that can take exponential time to evaluate when processing the <svelte:element this={tag}></svelte:element> syntax. This issue is particularly concerning if applications permit tags of unconstrained length, potentially leading to Denial of Service (DoS) conditions. If an attacker can manipulate the input to this tag, they could exploit the regex, causing the application to hang or crash.
How To Fix
Latest published version: 5.57.2 as of 23 Oct 2026
npm install svelte@5.57.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.55.7
This is the first release that contains the fix.
npm install svelte@5.55.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider implementing a workaround by restricting the length of tags passed to <svelte:element>. For example, you can trim the length of the tag before passing it: `
let safeTag = tag.length > 20 ? tag.slice(0, 20) : tag;
` This ensures that only tags of a manageable length are processed.
Conclusion
In summary, the vulnerability identified as CVE-2026-42567 in the Svelte framework can lead to significant performance issues if not addressed. By updating to the patched version or implementing a workaround, developers can safeguard their applications against potential exploitation.
See every vulnerability recorded for svelte →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application without signup using the Vulert playground at Vulert Scanner.
Versions of Svelte up to and including 5.55.6 are affected by this vulnerability.
If left unaddressed, this vulnerability could allow an attacker to exploit the regex, potentially leading to performance degradation or application crashes.
Yes, you can mitigate the risk by restricting the length of tags passed to <svelte:element>, ensuring that only safe, manageable lengths are processed.
References
Related vulnerabilities
Recent vulnerabilities recorded for svelte.
