Svelte Regular Expression Denial-of-Service Vulnerability in Element Tag Validation

A denial-of-service vulnerability has been identified in the Svelte web framework, specifically in versions 5.51.5 prior to 5.55.7. The issue arises from an internal regular expression in the Svelte runtime that can cause exponential time complexity when processing tags of unconstrained length within the `<svelte:element>` tag. This vulnerability can lead to significant performance degradation. However, applications that restrict tag lengths or allow only a predetermined list of tags are not affected.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition, leading to high availability impact by causing the application to become unresponsive or slow.

Remediation

Users can upgrade to Svelte version 5.55.7, where this vulnerability has been patched.