# CVE-2026-78661: Go HTML parser quadratic time complexity in text node coalescing

Source: https://junglewise.ai/threats/cve-2026-78661-when-coalescing-adjacent-text-nodes-in-addtext-and-fosterparent  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-78661 · Severity: info · Published 2026-10-27

Go's HTML parser has a performance defect in how it combines adjacent text fragments during parsing. Processing specially crafted HTML documents with many short text segments separated by ignored tags causes the parser to consume excessive CPU time and memory due to repeated string copying operations, potentially enabling denial of service attacks.

Technologies: [golang.org/x/net (Go)](https://junglewise.ai/threats/technologies/golang-org-x-net), [golang.org/x/net/html (Go)](https://junglewise.ai/threats/technologies/golang-org-x-net-html). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-78661 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78661 being exploited in the wild.

**How severe is CVE-2026-78661?** Informational severity, published 27 October 2026.

**Which products and versions are affected?** golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.62.0.

**Is there a fix for CVE-2026-78661?** Yes. golang.org/x/net (Go): upgrade to 0.62.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78661 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78661?** Check whether you run golang.org/x/net (Go) or golang.org/x/net/html (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- golang.org/x/net (Go): upgrade to 0.62.0 or later

  ```sh
  go get golang.org/x/net@v0.62.0
  ```


## Technical details

The vulnerability exists in the addText and fosterParent functions of Go's HTML parser, which concatenate text via string concatenation (n.Data += text), causing O(n²) allocations and byte copies when handling many short text runs separated by ignored end tags. An attacker can craft HTML input with patterns like "a</x>" repeated many times to trigger quadratic time complexity in parsing. The issue affects the golang.org/x/net/html package; a fix materializes coalesced text in per-node byte slices instead of reallocating on each append.

## Affected products

- Go golang.org/x/net/html

## Identifiers

- CVE-2026-78661
- GO-2026-6860

## References

- [https://pkg.go.dev/](https://pkg.go.dev/)
- [https://go.dev/cl/849365](https://go.dev/cl/849365)

## Related threats

- [Go html parser namespace handling in childTextNodesAreLiteral](https://junglewise.ai/threats/cve-2026-97045-in-childtextnodesareliteral-walking-up-the-tree-previously)
- [Google Go x/net denial of service in dnsmessage parsing](https://junglewise.ai/threats/cve-2026-46600-google-go-x-net-denial-of-service-in-dnsmessage-parsing)
- [Golang net/html Cross-Site Scripting via incorrect namespaced element parsing](https://junglewise.ai/threats/cve-2026-42506-golang-net-html-cross-site-scripting-via-incorrect-namespaced)
- [Google Go x/net/html XSS via incorrect foreign content parsing](https://junglewise.ai/threats/cve-2026-42502-google-go-x-net-html-xss-via-incorrect-foreign-content-parsing)
- [Go x/net idna privilege escalation via Punycode decoding](https://junglewise.ai/threats/cve-2026-39821-go-x-net-idna-privilege-escalation-via-punycode-decoding)