From 1b02aa28c8d746280617f59d6126b8b60f6cd748 Mon Sep 17 00:00:00 2001
From: Jawad Ali <contact.jawaddd@gmail.com>
Date: Tue, 25 Aug 2026 13:28:46 +0500
Subject: [PATCH] fix: decode uppercase-X hex numeric character references
 (#18708)

uppercase X is also valid per the HTML spec
---
 .changeset/uppercase-hex-entities.md                         | 5 +++++
 packages/svelte/src/compiler/phases/1-parse/utils/html.js    | 4 ++--
 .../tests/runtime-legacy/samples/html-entities/_config.js    | 1 +
 .../tests/runtime-legacy/samples/html-entities/main.svelte   | 1 +
 4 files changed, 9 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/uppercase-hex-entities.md

diff --git a/.changeset/uppercase-hex-entities.md b/.changeset/uppercase-hex-entities.md
new file mode 100644
index 0000000000..e6e13d5df5
--- /dev/null
+++ b/.changeset/uppercase-hex-entities.md
@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: decode uppercase-`X` hex numeric character references (`&#X...;`)
diff --git a/packages/svelte/src/compiler/phases/1-parse/utils/html.js b/packages/svelte/src/compiler/phases/1-parse/utils/html.js
index a0c2a5b06f..1d660298c7 100644
--- a/packages/svelte/src/compiler/phases/1-parse/utils/html.js
+++ b/packages/svelte/src/compiler/phases/1-parse/utils/html.js
@@ -20,7 +20,7 @@ function reg_exp_entity(entity_name, is_attribute_value) {
 
 /** @param {boolean} is_attribute_value */
 function get_entity_pattern(is_attribute_value) {
-	const reg_exp_num = '#(?:x[a-fA-F\\d]+|\\d+)(?:;)?';
+	const reg_exp_num = '#(?:[xX][a-fA-F\\d]+|\\d+)(?:;)?';
 	const reg_exp_entities = Object.keys(entities).map(
 		/** @param {any} entity_name */ (entity_name) => reg_exp_entity(entity_name, is_attribute_value)
 	);
@@ -50,7 +50,7 @@ export function decode_character_references(html, is_attribute_value) {
 			// Handle named entities
 			if (entity[0] !== '#') {
 				code = entities[entity];
-			} else if (entity[1] === 'x') {
+			} else if (entity[1] === 'x' || entity[1] === 'X') {
 				code = parseInt(entity.substring(2), 16);
 			} else {
 				code = parseInt(entity.substring(1), 10);
diff --git a/packages/svelte/tests/runtime-legacy/samples/html-entities/_config.js b/packages/svelte/tests/runtime-legacy/samples/html-entities/_config.js
index add763989e..82c87495c4 100644
--- a/packages/svelte/tests/runtime-legacy/samples/html-entities/_config.js
+++ b/packages/svelte/tests/runtime-legacy/samples/html-entities/_config.js
@@ -7,6 +7,7 @@ export default test({
 		<span>*</span>
 		<span>*</span>
 		<span>*</span>
+		<span>*</span>
 
 		<span></span>
 		<span>A</span>
diff --git a/packages/svelte/tests/runtime-legacy/samples/html-entities/main.svelte b/packages/svelte/tests/runtime-legacy/samples/html-entities/main.svelte
index 2d0d66c939..25a60cb930 100644
--- a/packages/svelte/tests/runtime-legacy/samples/html-entities/main.svelte
+++ b/packages/svelte/tests/runtime-legacy/samples/html-entities/main.svelte
@@ -2,6 +2,7 @@
 <span>&midast;</span>
 <span>&#x0002A;</span>
 <span>&#x0002A</span>
+<span>&#X0002A;</span>
 <span>&#42;</span>
 
 <span>&#10;</span>