From ff3495dc05bbdd81a225ba43446d82171b4413e3 Mon Sep 17 00:00:00 2001
From: Rich Harris <rich.harris@vercel.com>
Date: Wed, 1 Apr 2026 04:34:58 -0400
Subject: [PATCH] fix: disallow `--` in `idPrefix` (#18038)

supersedes #17993
---
 .changeset/evil-chicken-attend.md                    |  5 +++++
 .../docs/98-reference/.generated/server-errors.md    |  6 ++++++
 packages/svelte/messages/server-errors/errors.md     |  4 ++++
 packages/svelte/src/internal/server/errors.js        | 12 ++++++++++++
 packages/svelte/src/internal/server/renderer.js      |  4 ++++
 5 files changed, 31 insertions(+)
 create mode 100644 .changeset/evil-chicken-attend.md

diff --git a/.changeset/evil-chicken-attend.md b/.changeset/evil-chicken-attend.md
new file mode 100644
index 0000000000..f89e7e17f3
--- /dev/null
+++ b/.changeset/evil-chicken-attend.md
@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: disallow `--` in `idPrefix`
diff --git a/documentation/docs/98-reference/.generated/server-errors.md b/documentation/docs/98-reference/.generated/server-errors.md
index 0ee6fd0614..5e11c1c8c4 100644
--- a/documentation/docs/98-reference/.generated/server-errors.md
+++ b/documentation/docs/98-reference/.generated/server-errors.md
@@ -69,6 +69,12 @@ Cause:
 `csp.nonce` was set while `csp.hash` was `true`. These options cannot be used simultaneously.
 ```
 
+### invalid_id_prefix
+
+```
+The `idPrefix` option cannot include `--`.
+```
+
 ### lifecycle_function_unavailable
 
 ```
diff --git a/packages/svelte/messages/server-errors/errors.md b/packages/svelte/messages/server-errors/errors.md
index 533e5405ed..fe7f811787 100644
--- a/packages/svelte/messages/server-errors/errors.md
+++ b/packages/svelte/messages/server-errors/errors.md
@@ -53,6 +53,10 @@ This error occurs when using `hydratable` multiple times with the same key. To a
 
 > `csp.nonce` was set while `csp.hash` was `true`. These options cannot be used simultaneously.
 
+## invalid_id_prefix
+
+> The `idPrefix` option cannot include `--`.
+
 ## lifecycle_function_unavailable
 
 > `%name%(...)` is not available on the server
diff --git a/packages/svelte/src/internal/server/errors.js b/packages/svelte/src/internal/server/errors.js
index d1e594acfd..079bec3c91 100644
--- a/packages/svelte/src/internal/server/errors.js
+++ b/packages/svelte/src/internal/server/errors.js
@@ -105,6 +105,18 @@ export function invalid_csp() {
 	throw error;
 }
 
+/**
+ * The `idPrefix` option cannot include `--`.
+ * @returns {never}
+ */
+export function invalid_id_prefix() {
+	const error = new Error(`invalid_id_prefix\nThe \`idPrefix\` option cannot include \`--\`.\nhttps://svelte.dev/e/invalid_id_prefix`);
+
+	error.name = 'Svelte error';
+
+	throw error;
+}
+
 /**
  * `%name%(...)` is not available on the server
  * @param {string} name
diff --git a/packages/svelte/src/internal/server/renderer.js b/packages/svelte/src/internal/server/renderer.js
index 4bcb45512e..d2ab35a1f2 100644
--- a/packages/svelte/src/internal/server/renderer.js
+++ b/packages/svelte/src/internal/server/renderer.js
@@ -759,6 +759,10 @@ export class Renderer {
 	 * @returns {Renderer}
 	 */
 	static #open_render(mode, component, options) {
+		if (options.idPrefix?.includes('--')) {
+			e.invalid_id_prefix();
+		}
+
 		var previous_context = ssr_context;
 
 		try {