5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42567

CVE-2026-42567: Svelte: ReDoS in `<svelte:element>` Tag Validation

Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42567

CVE-2026-42567:

5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
svelte	npm	>= 5.51.5, <= 5.55.6	5.55.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) within the Svelte runtime, specifically affecting the validation of tag names in <svelte:element>. The root cause is an inefficient regular expression, REGEX_VALID_TAG_NAME, which contains nested quantifiers ((...)+)*) that can lead to exponential backtracking and catastrophic performance when processing certain input strings.

The security patch, identified in commit d2375e2ebcab5c88feb5652f1a9d621b8f06b259, addresses this by modifying the regex in packages/svelte/src/utils.js to a more efficient form, (...)*)?, thus eliminating the potential for ReDoS.

While the patch itself only modifies the regex definition, the actual vulnerability is triggered within the functions that invoke this regex. Analysis of the Svelte source code reveals two key functions where this occurs:

get_tag (client-side): This function is responsible for processing the this attribute of <svelte:element> in the browser. When it validates the tag name using the vulnerable regex, a malicious input can freeze the user's browser.
render_svelte_element (server-side): During server-side rendering, this function performs the same validation. A malicious tag can cause the server's Node.js process to hang, making the application unavailable to all users.

Therefore, during an exploit, these two functions would be the ones consuming excessive CPU time and would be prominently featured in any runtime profile or stack trace, indicating the source of the performance degradation.

Vulnerable functions

get_tag

packages/svelte/src/internal/client/dom/elements/misc.js

This function, used for client-side rendering, utilizes the vulnerable `REGEX_VALID_TAG_NAME` to validate the tag name provided to a `<svelte:element>`. A specially crafted tag can cause the regular expression to exhibit exponential backtracking, leading to a denial of service (ReDoS) in the browser.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.