# CVE-2026-97045: Go html parser namespace handling in childTextNodesAreLiteral

Source: https://junglewise.ai/threats/cve-2026-97045-in-childtextnodesareliteral-walking-up-the-tree-previously  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-97045 · Severity: info · Published 2026-10-27

The Go HTML parser has a logic error in how it determines whether to emit text content as literal characters versus parsed content. When HTML is re-parsed after being rendered, certain foster-parented elements in foreign namespaces (like MathML) could be resolved in different namespaces, potentially leading to parsing inconsistencies. This could affect applications that parse and re-parse untrusted HTML content.

Technologies: [golang.org/x/net (Go)](https://junglewise.ai/threats/technologies/golang-org-x-net). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-97045 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97045 being exploited in the wild.

**How severe is CVE-2026-97045?** Informational severity, published 27 October 2026.

**Which products and versions are affected?** golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.62.0.

**Is there a fix for CVE-2026-97045?** Yes. golang.org/x/net (Go): upgrade to 0.62.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97045 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97045?** Check whether you run Go standard library html package (Go) or golang.org/x/net (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- golang.org/x/net (Go): upgrade to 0.62.0 or later

  ```sh
  go get golang.org/x/net@v0.62.0
  ```


## Technical details

The childTextNodesAreLiteral function in Go's HTML parser incorrectly stops traversing the ancestor chain when it finds an HTML integration point, failing to check whether that integration point itself is a descendant of a foster-parented foreign element. This causes the parser to miss namespace transitions at foster-parented elements like mglyph or malignmark under mtext, resulting in different parsing behavior on re-parsing. The fix requires walking the full ancestor chain and verifying that every namespace transition occurs at an HTML integration point.

## Affected products

- Go Go standard library html package

## Identifiers

- CVE-2026-97045
- GO-2026-6866

## Timeline

- 2026-10-27: disclosed

## References

- [https://pkg.go.dev/](https://pkg.go.dev/)
- [https://go.dev/cl/855121](https://go.dev/cl/855121)

## Related threats

- [Go HTML parser quadratic time complexity in text node coalescing](https://junglewise.ai/threats/cve-2026-78661-when-coalescing-adjacent-text-nodes-in-addtext-and-fosterparent)
- [Google Go x/net denial of service in dnsmessage parsing](https://junglewise.ai/threats/cve-2026-46600-google-go-x-net-denial-of-service-in-dnsmessage-parsing)
- [Golang net/html Cross-Site Scripting via incorrect namespaced element parsing](https://junglewise.ai/threats/cve-2026-42506-golang-net-html-cross-site-scripting-via-incorrect-namespaced)
- [Google Go x/net/html XSS via incorrect foreign content parsing](https://junglewise.ai/threats/cve-2026-42502-google-go-x-net-html-xss-via-incorrect-foreign-content-parsing)
- [Go x/net idna privilege escalation via Punycode decoding](https://junglewise.ai/threats/cve-2026-39821-go-x-net-idna-privilege-escalation-via-punycode-decoding)