---
id: "CVE-2026-78661"
kind: "vulnerability"
aliases: ["CVE-2026-78661", "GO-2026-6860"]
title: "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "golang.org/x/net", "fixed": ["0.62.0"], "affected": "< 0.62.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "golang.org/x/net", "package", "self-hosted"]
not_affected_if: ["no-html-parsing", "trusted-input-only"]
published_at: "2026-10-27T21:16:18+00:00"
first_seen_at: "2026-10-27T22:19:32+00:00"
updated_at: "2026-10-27T22:19:53+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6860", "first_seen_at": "2026-10-27T22:19:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78661", "first_seen_at": "2026-10-27T22:29:29+00:00"}]
---

# Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

The golang.org/x/net HTML parser rebuilds an accumulated text node string on every token when adjacent text is merged, so crafted input with many small text runs separated by ignored end tags takes quadratic time and memory. An attacker can use this to make a service that parses untrusted HTML slow or resource-hungry.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:golang.org/x/net affected < 0.62.0 fixed 0.62.0

## How to check

- Run `go list -m golang.org/x/net` in the project to see the version in use
- Run `go version -m <binary> | grep golang.org/x/net` on built binaries

## Fix

- Upgrade golang.org/x/net to `0.62.0` or later

## Timeline

- 2026-10-27T22:19:32+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6860
- 2026-10-27T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-78661

## From the sources

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies.

Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_