CVE-2026-27125: Svelte SSR attribute spreading includes inherited properties from prototype chain
In server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected.
Other sources
svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27125?
CVE-2026-27125 is considered a moderate severity vulnerability due to its potential impact on server-side rendering behavior.
How do I fix CVE-2026-27125?
To fix CVE-2026-27125, update Svelte to version 5.51.5 or later.
What is the affected software for CVE-2026-27125?
CVE-2026-27125 affects Svelte versions up to 5.51.4.
What type of vulnerability is CVE-2026-27125?
CVE-2026-27125 is a vulnerability related to attribute spreading in server-side rendering that exposes inherited prototype properties.
When was CVE-2026-27125 published?
CVE-2026-27125 was published in 2026.