diff --git a/CHANGELOG.md b/CHANGELOG.md
index aec56e200b..1f74908bc9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Svelte changelog
 
+## 2.9.8
+
+* Sanitize spread attributes in SSR — fixes vulnerability CVE-2018-6341 ([#1623](https://github.com/sveltejs/svelte/pull/1623))
+
 ## 2.9.7
 
 * Allow `<input type=file bind:files>` ([#1608](https://github.com/sveltejs/svelte/issues/1608))
diff --git a/package.json b/package.json
index af2a3edcc4..8694352e1b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "svelte",
-  "version": "2.9.7",
+  "version": "2.9.8",
   "description": "The magical disappearing UI framework",
   "main": "compiler/svelte.js",
   "bin": {