CVE-2026-42567CWE-1333

Svelte: ReDoS in `<svelte:element>` Tag Validation

Medium · published June 9, 2026

CVSS v4.0
5.9
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.

The record
Technical detail
CVSS v4.0
5.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00440 · 37.2th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2026-06-09T16:22Z
EPSS history
Timeline
  • 09 JUN 16:22Z
    Svelte: ReDoS in `<svelte:element>` Tag Validation
    cvelistv5