Text Node Handling Vulnerability in Go Programming Language

CVE-2026-78661

What is CVE-2026-78661?

An issue exists in the Go programming language when coalescing adjacent text nodes during string concatenation processes. The algorithm used in functions like addText and fosterParent can lead to inefficient memory usage by reallocating and copying accumulated strings on each operation. This inefficiency is exacerbated in inputs comprised of numerous short text segments separated by ignored end tags, potentially resulting in performance degradation characterized by O(n^2) allocations and byte copies. To address this, it is recommended to implement byte slices for text accumulation at the node level during parsing, subsequently materializing Data strings only at the conclusion of the parsing process.

References