Is svelte 5.55 vulnerable?
npm · 11 releases from 5.55.0 to 5.55.10 · latest svelte is 5.57.3 · checked 2 Nov 2026
No known advisories in the last release
svelte 5.55.10, the last 5.55 release, has no known advisories. 4 advisories affect earlier 5.55.x releases, so update to 5.55.10.
npm install svelte@5.55.10Fixed within 5.55.x, affecting earlier releases
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
- Affected
- >=5.46.0 <5.55.7
- Fixed in
- 5.55.7
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
- Affected
- <5.55.7
- Fixed in
- 5.55.7
Svelte: ReDoS in `<svelte:element>` Tag Validation
- Affected
- >=5.51.5 <5.55.7
- Fixed in
- 5.55.7
Svelte SSR vulnerable to cross-site scripting via spread attributes
- Affected
- <5.55.7
- Fixed in
- 5.55.7
Which of your client projects are still on svelte 5.55?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact svelte version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other svelte versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.