CVE-2026-42567 Svelte: ReDoS in `<svelte:element>` Tag Validation
An attacker can cause a denial of service by triggering exponential time complexity in Svelte's internal regex validation for dynamic elements.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42567?
CVE-2026-42567 is a medium-severity denial of service vulnerability in sveltejs svelte, published on 9 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.
Weakness: CWE-1333
Which versions are affected by CVE-2026-42567?
2 open source packages ship an affected version, including svelte. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
svelte npm | From 5.51.5 | 5.55.7 |
svelte npm | From 5.51.5 | 5.55.7 |
Products include Svelte Svelte.
How do I fix CVE-2026-42567?
Upgrade svelte to 5.55.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-42567 being exploited?
There is no known exploitation of CVE-2026-42567 in the wild and no public exploit code.
Other vulnerabilities in sveltejs svelte
- CVE-2021-29261 Code injection in n/a
- CVE-2024-45047 Potential mXSS vulnerability due to improper HTML escaping in svelte
- CVE-2022-25875 Cross-site Scripting (XSS)
- CVE-2026-42573 Svelte: XSS via DOM Clobbering of Internal Framework State
- CVE-2026-27901 Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
Sources
Also known as GHSA-9rmh-mm8f-r9h6.