swc_html_minifier

Version	Released
`61.0.0` major	Aug 14, 2026
`60.0.0` major	Aug 08, 2026
`59.0.0` unknown	Jul 29, 2026
`58.0.0` unknown 1 CVE	Jul 18, 2026
`57.0.0` unknown 1 CVE	Jul 06, 2026
`56.0.0` unknown 1 CVE	Jun 18, 2026
`55.0.0` unknown 1 CVE	May 28, 2026
`54.0.0` unknown 1 CVE	May 25, 2026
`53.0.0` unknown 1 CVE	May 15, 2026
`52.0.0` unknown 1 CVE	Apr 18, 2026
`51.0.0` unknown 1 CVE	Apr 08, 2026
`50.0.0` unknown 1 CVE	Apr 03, 2026
`49.0.0` unknown 1 CVE	Apr 03, 2026
`48.0.0` unknown 1 CVE	Mar 30, 2026
`47.0.0` unknown 1 CVE	Mar 22, 2026
`46.0.0` unknown 1 CVE	Feb 25, 2026
`45.0.0` unknown 1 CVE	Feb 17, 2026
`44.0.0` unknown 1 CVE	Jan 27, 2026
`43.0.0` unknown 1 CVE	Jan 16, 2026
`42.0.0` unknown 1 CVE	Dec 30, 2025
`41.0.0` unknown 1 CVE	Dec 24, 2025
`40.0.0` unknown 1 CVE	Dec 18, 2025
`39.0.0` unknown 1 CVE	Dec 18, 2025
`38.0.0` unknown 1 CVE	Dec 04, 2025
`37.0.0` unknown 1 CVE	Nov 27, 2025
`36.0.0` unknown 1 CVE	Nov 03, 2025
`35.0.0` unknown 1 CVE	Oct 28, 2025
`34.0.0` unknown 1 CVE	Oct 21, 2025
`33.0.0` unknown 1 CVE	Sep 26, 2025
`32.0.0` unknown 1 CVE	Sep 06, 2025
`31.0.0` unknown 1 CVE	Aug 29, 2025
`30.0.0` unknown 1 CVE	Aug 19, 2025
`29.0.0` unknown 1 CVE	Aug 05, 2025
`28.0.0` unknown 1 CVE	Jul 22, 2025
`27.0.1` unknown 1 CVE	Jul 21, 2025
`27.0.0` unknown 1 CVE	Jul 17, 2025
`26.0.0` unknown 1 CVE	Jul 13, 2025
`25.0.0` unknown 1 CVE	Jul 07, 2025
`24.0.1` unknown 1 CVE	Jul 04, 2025
`24.0.0` unknown 1 CVE	Jul 02, 2025
`23.0.0` unknown 1 CVE	Jun 19, 2025
`22.0.0` unknown 1 CVE	Jun 18, 2025
`21.0.0` unknown 1 CVE	Jun 10, 2025
`20.0.0` unknown 1 CVE	May 20, 2025
`19.0.0` unknown 1 CVE	May 16, 2025
`18.0.0` unknown 1 CVE	May 12, 2025
`17.0.0` unknown 1 CVE	May 02, 2025
`16.0.0` unknown 1 CVE	Apr 07, 2025
`15.0.0` unknown 1 CVE	Apr 04, 2025
`14.0.0` unknown 1 CVE	Mar 31, 2025

61.0.0 major

Aug 14, 2026

60.0.0 major

Aug 08, 2026

59.0.0 unknown

Jul 29, 2026

58.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jul 18, 2026

57.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jul 06, 2026

56.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jun 18, 2026

55.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

May 28, 2026

54.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

May 25, 2026

53.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

May 15, 2026

52.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Apr 18, 2026

51.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Apr 08, 2026

50.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Apr 03, 2026

49.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Apr 03, 2026

48.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Mar 30, 2026

47.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Mar 22, 2026

46.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Feb 25, 2026

45.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Feb 17, 2026

44.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jan 27, 2026

43.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jan 16, 2026

42.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Dec 30, 2025

41.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Dec 24, 2025

40.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Dec 18, 2025

39.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Dec 18, 2025

38.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Dec 04, 2025

37.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Nov 27, 2025

36.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Nov 03, 2025

35.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Oct 28, 2025

34.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Oct 21, 2025

33.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Sep 26, 2025

32.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Sep 06, 2025

31.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Aug 29, 2025

30.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Aug 19, 2025

29.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Aug 05, 2025

28.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jul 22, 2025

27.0.1 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jul 21, 2025

27.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jul 17, 2025

26.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jul 13, 2025

25.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jul 07, 2025

24.0.1 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jul 04, 2025

24.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jul 02, 2025

23.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jun 19, 2025

22.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jun 18, 2025

21.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Jun 10, 2025

20.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

May 20, 2025

19.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

May 16, 2025

18.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

May 12, 2025

17.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

May 02, 2025

16.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Apr 07, 2025

15.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Apr 04, 2025

14.0.0 unknown

1 CVE

CVE-2026-72925 GHSA-5qr2-v392-m9g8 Sep 08, 2026

SWC HTML minifier may allow script element breakout when minifying embedded JSON

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Impact

@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

Patches

The issue is fixed in:

@swc/html 1.15.47
swc_html_minifier 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

Workarounds

Users who cannot upgrade can disable JSON minification with:

await minify(html, {
  minifyJson: false,
});

Fixed in


          59.0.0

References

Updated Sep 08, 2026 · Source: OSV.dev

Mar 31, 2025

Activity

Reach

Details