Is svelte 5.53 vulnerable?
npm · 14 releases from 5.53.0 to 5.53.13 · latest svelte is 5.57.3 · checked 2 Nov 2026
Yes: 4 known advisories
Yes. svelte 5.53.13, the last 5.53 release, is affected by 4 known security advisories (4 medium), including CVE-2026-42573, CVE-2026-42567, CVE-2026-42599. 2 more affect earlier 5.53.x releases. Upgrade to 5.55.7 or later to fix all of them.
npm install svelte@5.55.7Advisories affecting svelte 5.53.13
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
- Affected
- >=5.46.0 <5.55.7
- Fixed in
- 5.55.7
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
- Affected
- <5.55.7
- Fixed in
- 5.55.7
Svelte: ReDoS in `<svelte:element>` Tag Validation
- Affected
- >=5.51.5 <5.55.7
- Fixed in
- 5.55.7
Svelte SSR vulnerable to cross-site scripting via spread attributes
- Affected
- <5.55.7
- Fixed in
- 5.55.7
Fixed within 5.53.x, affecting earlier releases
Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers
- Affected
- >=5.53.0 <5.53.5
- Fixed in
- 5.53.5
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
- Affected
- <5.53.5
- Fixed in
- 5.53.5
Which of your client projects are still on svelte 5.53?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact svelte version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other svelte versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.