CVE-2026-78661 Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-78661?
CVE-2026-78661 is a vulnerability in golang.org/x/net/html, published on 27 Oct 2026.
Official description
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
Which versions are affected by CVE-2026-78661?
1 open source package ship an affected version, including golang.org/x/net.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/net Go | All versions | 0.62.0 |
How do I fix CVE-2026-78661?
Upgrade golang.org/x/net to 0.62.0 or later.
Is CVE-2026-78661 being exploited?
There is no known exploitation of CVE-2026-78661 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-FA45918, DEBIAN-CVE-2026-78661, ECHO-3093-63b1-15db, GHSA-75pg-wvh3-34jr, GO-2026-6860, MINI-25v9-vp4m-j6h8 and 113 more.