CVE-2026-42567: Svelte: ReDoS in `<svelte:element>` Tag Validation
An internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to svelte:element, you are safe.
Other sources
Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/svelteto a version that resolves this vulnerability.Fixed in 5.55.7 - Configuration
Only pass tag names from a predefined whitelist to <svelte:element this={tag}>. Reject or map any tag values that are not explicitly allowed.
<svelte:element> usage allowed_tags = predetermined list - Configuration
Trim or validate the length of the tag string before passing it to <svelte:element this={tag}> to ensure tag values are constrained and cannot trigger the vulnerable regex.
<svelte:element> usage max_tag_length = trimmed to a safe length
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42567?
CVE-2026-42567 has a medium severity rating due to the potential for denial of service from regex performance issues.
How do I fix CVE-2026-42567?
To fix CVE-2026-42567, upgrade to Svelte version 5.55.7 or later.
What causes CVE-2026-42567?
CVE-2026-42567 is caused by an internal regex in the Svelte runtime that can lead to exponential time complexity when processing unconstrained tags.
Am I vulnerable to CVE-2026-42567 if I restrict tag length?
No, if your application restricts tag length or only allows a predetermined list of tags, you are not vulnerable to CVE-2026-42567.
Which versions of Svelte are affected by CVE-2026-42567?
CVE-2026-42567 affects Svelte versions between 5.51.5 and 5.55.6, inclusive.