VYPR
← All advisories
High severity7.5GHSA Advisory· Published Jun 9, 2026· Updated Jun 11, 2026

CVE-2026-42567

CVE-2026-42567

Description

Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
sveltenpm
>= 5.51.5, < 5.55.75.55.7

Affected products

3
  • Sveltejs/SvelteGHSA2 versions
    >= 5.51.5, <= 5.55.6+ 1 more
    • (no CPE)range: >= 5.51.5, <= 5.55.6
    • cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:*range: >=5.51.5,<5.55.7
  • ghsa-coords
    pkg:npm/svelte
    Range: >= 5.51.5, < 5.55.7

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.