CVE-2026-42567

Description

Svelte: ReDoS in `<svelte:element>` Tag Validation

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2026-42567 on 2026-07-28. Shown when MITRE's text differs from the cvelistV5 mirror.

Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.

Overview

State

—

Assigner (CNA)

—

CVSS severity

critical

CVSS score

9.1 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Effective score

9.1 / 10 CRITICAL source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-42567

Linked Threat

CVE-2026-42567 — CVE-2026-42567

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-35702

Assigner

GitHub_M

Published

Jun 9, 2026, 4:22:22 PM

Updated

Jun 9, 2026, 6:09:26 PM

EUVD base score (CVSS 4.0)

5.9 / 10
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EUVD-reported EPSS

0.4200

Vendors

sveltejs

Products

svelte (5.51.5, < 5.55.7)

Aliases

GHSA-9rmh-mm8f-r9h6

ENISA description: Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

MITRE references (2) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

• https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7 x_refsource_MISC
• https://github.com/sveltejs/svelte/security/advisories/GHSA-9rmh-mm8f-r9h6 x_refsource_CONFIRM

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-42567 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-42567 tenable:www.cve.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Oracle Critical Patch Update, April 2026 Security Update Review
  web:blog.qualys.com

  Oracle released its second quarterly edition of this year's Critical Patch Update. The update received patches for 481 security vulnerabilities.

  2026-05-26 02:54 UTC
• CVE Database Search & Remediation Guidance | CVEDatabase.com
  web:cvedatabase.com

  Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.

  2026-05-26 02:54 UTC
• Nvd - Cve-2026-44277
  web:nvd.nist.gov

  Official websites use .gov A .gov website belongs to an official government organization in the United States.

  2026-05-26 02:54 UTC
• Addressing Exchange Server May 2026 vulnerability CVE-2026-42897
  web:techcommunity.microsoft.com

  We wanted to tell you how to address the Exchange Server May 2026 vulnerability CVE - 2026 -42897.

  2026-05-26 02:54 UTC
• Known Exploited Vulnerabilities Catalog - CISA
  web:www.cisa.gov

  For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.

  2026-05-26 02:54 UTC
• Microsoft Confirms Active 0-Day Exploit—Check Emergency Mitigation
  web:www.forbes.com

  Updated May 17: This article, originally published May 16, has been updated to include further details on the emergency mitigation process recommended after the CVE - 2026 -42897 Microsoft Exchange ...

  2026-05-26 02:54 UTC
• Microsoft May 2026 Patch Tuesday: Many fixes, but no zero-days
  web:www.helpnetsecurity.com

  Microsoft has marked May 2026 Patch Tuesday by releasing fixes for 120+ CVE -numbered vulnerabilities, none of which are actively exploited.

  2026-05-26 02:54 UTC
• Critical Patch Updates, Critical Security Patch Updates ... - Oracle
  web:www.oracle.com

  Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.

  2026-05-26 02:54 UTC
• Oracle Patches 450 Vulnerabilities With April 2026 CPU
  web:www.securityweek.com

  Oracle on Tuesday announced the release of 481 new security patches as part of its April 2026 Critical Patch Update (CPU). Across the 28 product families that received security updates, more than 300 patches address vulnerabilities that are remotely exploitable without authentication.

  2026-05-26 02:54 UTC
• Patch Tuesday May 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-05-26 02:54 UTC

Only Available for Registered Users. Sign in to view.