CVE-2026-78661
Low risk· EPSS 8%Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation reallocated and copied the accumulated string on every token. Inputs with many short text runs separated by ignored end tags caused O(n^2) allocations and byte copies. The fix accumulates coalesced text in per-node byte slices and materializes Data strings once at the end of parsing.
Risk Assessment
Malicious input can cause excessive CPU and memory consumption (denial of service) during HTML parsing.
Recommendation
Update the HTML parser library to a patched version and consider size limits on parsed documents.
Other vulnerabilities in HTML parser
See all- CVE-2026-97045Low risk· EPSS 10%
In childTextNodesAreLiteral, tree walking stopped at the nearest foreign ancestor once an HTML integration point was found. Because that integration point may itself be a descendant of a foster-parented element in a foreign namespace, a parser may resolve the subtree in a different namespace upon re-parsing rendered output. The fix continues walking the full ancestor chain and verifies every namespace transition occurs at an HTML integration point.
- CVE-2026-25680Medium
Parsing arbitrary HTML can consume excessive CPU time, leading to denial of service (DoS).
Original NVD description (English source)
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS