CVE-2026-25680
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Parsing arbitrary HTML can consume excessive CPU time, leading to denial of service (DoS).
Risk Assessment
The organization is at risk of DoS attacks via malicious HTML, potentially slowing or blocking application functionality.
Recommendation
Implement timeouts and resource limits for the HTML parser, and consider using a more secure library.
Other vulnerabilities in HTML parser
See all- CVE-2026-97045Low risk· EPSS 10%
In childTextNodesAreLiteral, tree walking stopped at the nearest foreign ancestor once an HTML integration point was found. Because that integration point may itself be a descendant of a foster-parented element in a foreign namespace, a parser may resolve the subtree in a different namespace upon re-parsing rendered output. The fix continues walking the full ancestor chain and verifies every namespace transition occurs at an HTML integration point.
- CVE-2026-78661Low risk· EPSS 8%
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation reallocated and copied the accumulated string on every token. Inputs with many short text runs separated by ignored end tags caused O(n^2) allocations and byte copies. The fix accumulates coalesced text in per-node byte slices and materializes Data strings once at the end of parsing.
Original NVD description (English source)
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS