High severity · published Jun 9, 2026
CVE-2026-42567
Svelte: ReDoS in `<svelte:element>` Tag Validation
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SV
svelte · sveltejs
>= 5.51.5, < 5.55.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42567
Product
https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7
Vendor Advisory
https://github.com/sveltejs/svelte/security/advisories/GHSA-9rmh-mm8f-r9h6
More from svelte
6.8
CVE-2026-27125
Svelte SSR attribute spreading includes inherited properties from prototype chain
6.1
CVE-2026-42599
Cross-site scripting via spread attributes in Svelte SSR
6.1
CVE-2026-42573
Svelte: XSS via DOM Clobbering of Internal Framework State
6.1
CVE-2026-27901
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
5.4
CVE-2026-27902
Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers