Description
An internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to svelte:element, you are safe.
Recommendation
Update the svelte package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.51.5, <= 5.55.6
- Patched version(s): 5.55.7
References
Related Issues
- Svelte SSR does not validate dynamic element tag names in `<svelte:element>` - CVE-2026-27122
- Svelte affected by XSS in SSR `<option>` element - CVE-2026-27119
- SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6 - CVE-2026-34526
- ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag - CVE-2026-8813
You might also like:
- Tags:
- npm
- svelte
Anything's wrong? Let us know Last updated on June 09, 2026