Svelte: ReDoS in `<svelte:element>` Tag Validation

Description

An internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to svelte:element, you are safe.

Recommendation

Update the svelte package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.51.5, <= 5.55.6
• Patched version(s): 5.55.7

References

• GHSA-9rmh-mm8f-r9h6
• CVE-2026-42567
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Svelte SSR does not validate dynamic element tag names in `<svelte:element>` - CVE-2026-27122
• Svelte affected by XSS in SSR `<option>` element - CVE-2026-27119
• LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex - CVE-2026-45617
• tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability - CVE-2026-22809

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

svelte