Go net/html CVE-2026-27136

Upgrade golang.org/x/net/html to version 0.55.0 or later, which contains the fix applied in change list https://go.dev/cl/781685. Update your go.mod dependency and rebuild affected binaries. The fix version (0.55.0) is confirmed by the EUVD affected version range and the Go vulnerability database entry at https://pkg.go.dev/vuln/GO-2026-5030. If an immediate upgrade is not feasible, the most effective compensating control is to avoid re-rendering sanitized HTML using the same golang.org/x/net/html Render function - instead, serve the sanitized intermediate representation as escaped plain text or use a Content Security Policy (CSP) with script-src 'none' or strict nonce-based policy to neutralize injected scripts even if they survive sanitization. Note that CSP alone does not eliminate the vulnerability but significantly reduces exploitability. A strict CSP may break legitimate inline script usage in your application, so evaluate trade-offs before deploying. Alternatively, route all user-supplied HTML through a dedicated, well-maintained sanitization library rather than relying on parse-sanitize-render pipelines against this version of golang.org/x/net/html.