npm/svelte CVE-2026-27122: medium 5.4, EPSS 0.22%

Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

Action: Upgrade svelte to 5.51.5 or later.

npm i svelte@5.51.5

Affected

Fixed versions

Sources

• osv: GHSA-m56q-vw4c-c2cp
• nvd: CVE-2026-27122
• https://github.com/sveltejs/svelte/security/advisories/GHSA-m56q-vw4c-c2cp
• https://github.com/sveltejs/svelte

CVE-2026-27122 · published 2026-02-19T15:18:42Z · modified 2026-09-10T03:50:35.273929194Z · JSON