CVE-2026-42567

Name of the Vulnerable Software and Affected Versions Svelte versions 5.51.5 through 5.55.6

Description An internal regular expression in the Svelte runtime can experience exponential time complexity during testing when using the <svelte:element this={tag}></svelte:element> component. This issue occurs specifically when tags of unconstrained length are permitted. The risk is mitigated if the application restricts tags to a predetermined list or trims their length before they are passed to the this variable.

Recommendations Update to version 5.55.7. As a temporary mitigation, restrict the length of tags or use a predetermined list of allowed tags before passing them to the this variable in the <svelte:element> component.