golang.org/x/net/html EUVD-2026-31446

Upgrade golang.org/x/net to version 0.55.0 or later by running go get golang.org/x/net@v0.55.0 and rebuilding all affected services. The fix is documented at pkg.go.dev/vuln/GO-2026-5025 and implemented in code change https://go.dev/cl/781700. For teams unable to patch immediately, the most effective compensating control is replacing the parse-sanitize-render pipeline with a dedicated HTML sanitization library such as bluemonday, which serializes output independently of golang.org/x/net/html's Render() function, eliminating the parser-differential attack surface entirely. Alternatively, applying a strict allow-list output encoding pass after Render() can reduce exposure, but adds complexity and is not a substitute for patching. Deploying strict Content Security Policy headers (script-src 'self' or nonce-based) limits the impact of any XSS that does execute, though CSP is a defense-in-depth layer and should not be treated as primary mitigation. The golang-announce mailing list entry at https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 contains additional advisory context.