CVE-2026-42567mediumCWE-1333

CVE-2026-42567: medium-severity vulnerability in sveltejs svelte

Svelte: ReDoS in `<svelte:element>` Tag Validation

Published

Follow this CVE+ Monitor svelte+ Monitor svelte

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.5%
Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
sveltejs · svelte
Related CVEs — sveltejs svelte

In the same product, most dangerous first.

CVE-2026-27125MEDIUMSvelte SSR attribute spreading includes inherited properties from prototype chainEPSS 0.4%CVE-2024-45047MEDIUMPotential mXSS vulnerability due to improper HTML escaping in svelteEPSS 0.4%CVE-2026-42573MEDIUMSvelte: XSS via DOM Clobbering of Internal Framework StateEPSS 0.3%CVE-2026-27902MEDIUMSvelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration MarkersEPSS 0.3%CVE-2026-27901MEDIUMSvelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`EPSS 0.3%CVE-2026-27122MEDIUMSvelte SSR does not validate dynamic element tag names in `<svelte:element>`EPSS 0.2%