Unscored severity · published Oct 27, 2026
CVE-2026-78661
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
New
–
CVSS
–
EPSS
No
On KEV
Description
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
golang.org/x/net/html · golang.org/x/net
before 0.62.0 · source: vendor
Affected product
GO
golang.org/x/net/html
golang.org/x/net
More from golang.org/x/net/html
6.5
CVE-2026-25680
Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
6.1
CVE-2026-27136
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
6.1
CVE-2026-25681
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
6.1
CVE-2026-42502
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
6.1
CVE-2026-42506
Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html