CVE-2026-78661
golang.org/x/net/html: Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
golang.org/x/net golang.org/x/net/html
CVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 0.62.0golang.org/x/net/htmlCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
Text from CVE List
Affected versions 1
- golang.org/x/net/htmlaffected: all versions before 0.62.0CVE List