https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T04:39:45.546473+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-326009 EUVD-2026-326009 2026-10-06T04:39:45.549346+00:00 EUVD-2026-326009 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42567 fkie_cve-2026-42567 2026-10-06T04:39:45.549381+00:00

Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.

 https://cve.radiocsirt.org/vuln/ghsa-9rmh-mm8f-r9h6 GHSA-9rmh-mm8f-r9h6 — Svelte: ReDoS in `<svelte:element>` Tag Validation 2026-10-06T04:39:45.549413+00:00

Affected: npm: svelte

An internal regex in the Svelte runtime can take exponential time to test in `<svelte:element this={tag}></svelte:element>`. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to `svelte:element`, you are safe.