crates.io/swc_html_minifier CVE-2026-72925: medium 6.1, EPSS 0.34%

SWC HTML minifier may allow script element breakout when minifying embedded JSON

Action: Upgrade swc_html_minifier to 59.0.0 or later.

cargo update -p swc_html_minifier --precise 59.0.0

Affected

Fixed versions

Sources

• osv: GHSA-5qr2-v392-m9g8#crates.io/swc_html_minifier
• https://github.com/swc-project/swc/security/advisories/GHSA-5qr2-v392-m9g8
• https://nvd.nist.gov/vuln/detail/CVE-2026-72925
• https://github.com/swc-project/swc/pull/12080
• https://github.com/swc-project/swc/commit/e1877b44bdac8abc9fd51e984d584f40f6999832
• https://github.com/swc-project/swc
• https://github.com/swc-project/swc/releases/tag/v1.15.47
• https://github.com/swc-project/swc/releases/tag/v1.15.47-nightly-20260729.1

CVE-2026-72925 · published 2026-09-08T17:58:00Z · modified 2026-09-08T18:15:03.995774389Z · JSON