Svelte: ReDoS in `<svelte:element>` Tag Validation

Description

An internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to svelte:element, you are safe.

Recommendation

Update the svelte package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.51.5, <= 5.55.6
• Patched version(s): 5.55.7

References

• GHSA-9rmh-mm8f-r9h6
• CVE-2026-42567
• CWE-1333
• CAPEC-310
• OWASP 2021-A6