CVE-2026-42567 describes a vulnerability in the Svelte web framework where an internal regular expression used in the runtime exhibits exponential time complexity when processing the <svelte:element this={tag}></svelte:element> syntax. This inefficiency can lead to performance degradation or denial of service conditions. The affected versions are from 5.51.5 up to but not including 5.55.7. The issue has been patched in version 5.55.7. No known exploits in the wild have been reported.

The vulnerability can cause significant performance degradation due to the exponential time complexity of the regex evaluation, potentially leading to denial of service in applications using affected Svelte versions. The impact requires high privileges and user interaction, and the attack complexity is high, limiting the ease of exploitation.

Upgrade Svelte to version 5.55.7 or later, where this inefficient regular expression issue has been patched. No other mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the version fix information.