Frontend framework
Svelte: supported versions and open vulnerabilities today
Svelte 5 is supported; 4 reached end of life on Oct 19, 2024; the latest release is 5.57.2. 4 high or critical advisories for Svelte were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, npm, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 5.57.2
- npm downloads last week
- 6.8M
- GitHub stars
- 88.4k
- Licence
- MIT
- OpenSSF Scorecard
- 7.6 / 10
Supported versions
Security advisories
23 advisories published in the last 12 months, 4 of them high or critical. 31 in total since records began. Checked packages: svelte and @sveltejs/kit.
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass
Fixed in 2.57.1.
Affects @sveltejs/kit.
EPSS: top 40%svelte is vulnerable to XSS with textarea bind:value
Fixed in 3.59.2.
Affects svelte.
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)
Fixed in 2.49.5.
Affects @sveltejs/kit.
EPSS: top 53%SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
Fixed in 2.49.5.
Affects @sveltejs/kit.
EPSS: top 58%
All svelte advisories on OSV.devAll @sveltejs/kit advisories on OSV.dev
Maintenance and supply chain
OpenSSF Scorecard 7.6 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 7 issue updates found in the last 90 days.
Weakest checks
- No fuzzing (Fuzzing 0/10)
- No OpenSSF best-practices badge (CII-Best-Practices 0/10)
- No static analysis (SAST 2/10)
Docs and release notes
Check Svelte in your own stack
This page checks Svelte in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.