Svelte: SSR XSS via Insecure Promise Serialization in hydratable

MEDIUMGHSA-f3cj-j4f6-wq85 · Published 14/05/2026 · updated 14/05/2026

In short

GHSA-f3cj-j4f6-wq85 is a MEDIUM vulnerability affecting svelte.
Fix: update to 5.55.7 or later.

Package	Affected versions	Patched versions
svelte npm	`≥ 5.46.0, < 5.55.7`	`5.55.7`

Description

Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:

you are using hydratable (an experimental feature at the time of this report)
you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. hydratable('someKey', () => [synchronousValue, promiseValue])

References

sveltejs/svelte security advisory · WEB
sveltejs/svelte commit a16ebc6 · WEB
sveltejs/svelte · PACKAGE
sveltejs/svelte release [email protected] · WEB

More vulnerabilities in svelte

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

svelte

npm

≥ 5.46.0, < 5.55.7

5.55.7

Description

Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:

you are using hydratable (an experimental feature at the time of this report)
you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. hydratable('someKey', () => [synchronousValue, promiseValue])

More vulnerabilities in svelte

See all →