A vulnerable regular expression in Svelte’s runtime can exhaust CPU time during tag name validation for the <svelte:element> component. This results in a denial‑of‑service condition by consuming excessive processor resources. The flaw is classified as a regular expression denial of service (CWE-1333) and provides no direct compromise of confidentiality or integrity, only availability degradation.

Svelte framework version 5.51.5 through 5.55.6 for the sveltejs svelte product. The issue was resolved in version 5.55.7 and later.

The CVSS score of 5.9 indicates moderate risk. EPSS information is not available, meaning the current probability of exploitation is unknown. The vulnerability is not listed in CISA KEV. The likely attack vector is via user‑controlled tag names supplied to <svelte:element>; an attacker could trigger the expensive regular expression to cause high CPU usage, potentially affecting availability of the application.