| Package | Affected versions | Patched versions |
|---|---|---|
| svelte | ≥ 5.51.5, < 5.55.7 | 5.55.7 |
| svelte | ≥ 5.51.5, < 5.55.7 | 5.55.7 |
An internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to svelte:element, you are safe.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free