From b6faa2a905804f77a6c486729f9ce8325c273273 Mon Sep 17 00:00:00 2001
From: Paolo Ricciuti <ricciutipaolo@gmail.com>
Date: Fri, 27 Feb 2026 21:08:42 +0100
Subject: [PATCH] fix: always case insensitive event handlers during ssr
 (#17822)

Fixes events not being stripped on svg, mathml and custom elements.

### Before submitting the PR, please make sure you do the following

- [x] It's really useful if your PR references an issue where it is
discussed ahead of time. In many cases, features are absent for a
reason. For large changes, please create an RFC:
https://github.com/sveltejs/rfcs
- [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`.
- [x] This message body should clearly illustrate what problems it
solves.
- [x] Ideally, include a test that fails without this PR but passes with
it.
- [x] If this PR changes code within `packages/svelte/src`, add a
changeset (`npx changeset`).

### Tests and linting

- [x] Run the tests with `pnpm test` and lint the project with `pnpm
lint`

---------

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>
---
 .changeset/proud-seas-study.md                   |  5 +++++
 packages/svelte/src/internal/server/index.js     |  7 +++----
 .../attribute-strip-svg-mathml-ce/_expected.html |  1 +
 .../attribute-strip-svg-mathml-ce/main.svelte    | 16 ++++++++++++++++
 4 files changed, 25 insertions(+), 4 deletions(-)
 create mode 100644 .changeset/proud-seas-study.md
 create mode 100644 packages/svelte/tests/server-side-rendering/samples/attribute-strip-svg-mathml-ce/_expected.html
 create mode 100644 packages/svelte/tests/server-side-rendering/samples/attribute-strip-svg-mathml-ce/main.svelte

diff --git a/.changeset/proud-seas-study.md b/.changeset/proud-seas-study.md
new file mode 100644
index 0000000000..ec12b7232a
--- /dev/null
+++ b/.changeset/proud-seas-study.md
@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: always case insensitive event handlers during ssr
diff --git a/packages/svelte/src/internal/server/index.js b/packages/svelte/src/internal/server/index.js
index 70f1f6dab8..34d0133a31 100644
--- a/packages/svelte/src/internal/server/index.js
+++ b/packages/svelte/src/internal/server/index.js
@@ -154,13 +154,12 @@ export function attributes(attrs, css_hash, classes, styles, flags = 0) {
 		if (INVALID_ATTR_NAME_CHAR_REGEX.test(name)) continue;
 
 		var value = attrs[name];
+		var lower = name.toLowerCase();
 
-		if (lowercase) {
-			name = name.toLowerCase();
-		}
+		if (lowercase) name = lower;
 
 		// omit event handler attributes
-		if (name.length > 2 && name.startsWith('on')) continue;
+		if (lower.length > 2 && lower.startsWith('on')) continue;
 
 		if (is_input) {
 			if (name === 'defaultvalue' || name === 'defaultchecked') {
diff --git a/packages/svelte/tests/server-side-rendering/samples/attribute-strip-svg-mathml-ce/_expected.html b/packages/svelte/tests/server-side-rendering/samples/attribute-strip-svg-mathml-ce/_expected.html
new file mode 100644
index 0000000000..e737f44c56
--- /dev/null
+++ b/packages/svelte/tests/server-side-rendering/samples/attribute-strip-svg-mathml-ce/_expected.html
@@ -0,0 +1 @@
+<!--[--><svg><circle cx="12" cy="12" r="10"></circle></svg> <math><mi>x</mi></math> <custom-element></custom-element><!--]-->
\ No newline at end of file
diff --git a/packages/svelte/tests/server-side-rendering/samples/attribute-strip-svg-mathml-ce/main.svelte b/packages/svelte/tests/server-side-rendering/samples/attribute-strip-svg-mathml-ce/main.svelte
new file mode 100644
index 0000000000..df15de54de
--- /dev/null
+++ b/packages/svelte/tests/server-side-rendering/samples/attribute-strip-svg-mathml-ce/main.svelte
@@ -0,0 +1,16 @@
+<script>
+  const userdata = {
+    ONCLICK: 'alert(document.cookie)',
+    ONMOUSEOVER: 'alert("XSS")'
+  };
+</script>
+
+<svg {...userdata}>
+  <circle cx="12" cy="12" r="10" />
+</svg>
+
+<math {...userdata}>
+  <mi>x</mi>
+</math>
+
+<custom-element {...userdata}></custom-element>
\ No newline at end of file