[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
parse5 (source)	8.1.0 → 8.1.1

---

Release Notes

inikulin/parse5 (parse5)

v8.1.1

Compare Source

This release fixes nineteen security-relevant issues in the tokenizer, serializer, SAX parser, rewriting stream, tree adapters and tree construction, reported by outside researchers and by Anthropic, and further issues of the same kinds found while reviewing them. The issues include crashes from a few bytes of input, parse time and memory far out of proportion to the input, and serializer output that re-parses into markup the parsed tree did not contain. Everyone who runs parse5 on untrusted input should update.

There are no CVEs or GitHub security advisories for these issues: private vulnerability reporting on this repository is only accessible to @​inikulin. The current maintainers cannot access it, so the reports could not be filed or published as advisories here.

Security fixes

• 9b57bf87 High: a crash from two code units. A lone low surrogate followed by another low surrogate was decoded as a pair, and String.fromCodePoint then threw out of every parser entry point. Only a high surrogate now starts a pair. Reported by Joshua Rogers and by Anthropic.
• 98a4bb34 High: a crash, also through cheerio's $.html(). Serialization recursed once per DOM level, so a few KB of nesting exhausted the call stack. It now uses an explicit stack, and the output is unchanged byte for byte. Reported by SnailSploit.
• ea240155 High: quadratic parse time. The SAX parser's namespace stack was shifted from the front for every element, quadratic in the nesting. It is kept at its tail. Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina.
• fa1eb9b0 High: a crash, and quadratic time before it. Nested templates were closed recursively at EOF, and the template insertion-mode stack was shifted per template. Both are iterative now. Reported by SnailSploit and by the three reporters above.
• 20591465 High: quadratic parse time. Foster parenting scanned all preceding siblings of the table for every insertion. The reference is found without scanning. Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina.
• 6c705d57 High: 8,002,000 attribute records from 39 KB of input. Integration-point checks read the attribute list of every element, which the htmlparser2 adapter allocates on each call. Only annotation-xml needs it, and its list is now read once per element, as the HTML Standard decides by the start tag (rereading it on every pop took 7 s for 8,000 attributes and children; a script that edits encoding mid-parse no longer changes the verdict, stated in the commit). Reported by Anthropic; the rereads on every pop were found while reviewing this series.
• 0a61bd54 High: 210 ms from 35 KB, growing quadratically. adoptAttributes rebuilt the recipient's name Set for an empty merge, so repeated <html> and <body> tags without attributes were quadratic. It returns early. Tags that each add an attribute rebuilt it too (816 ms for 8,000 <html> tags), so the adapter now keeps the names between merges and re-indexes when the list changed under it; a script that renames an attribute between two merges to a name the cache has never seen is the one documented difference (stated in the commit). Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina; the merges that add attributes were found while reviewing this series.
• 89dceda8 High: a crash and mutation XSS. Resetting the insertion mode matched foreign elements by tag id, so an SVG select or template selected an HTML mode; a TypeError followed from 50 bytes, and a longer shape serialized into an <img onerror> absent from the tree. Foreign elements are skipped. Reported by Anthropic.
• f5d58d8f High: quadratic parse time from formatting tags. Formatting tags with distinct attributes (<b a=1><b a=2>…) made every insertion into the list of active formatting elements scan the list for Noah's Ark, and formatting end tags scanned and spliced it. The list is now linked and indexed by tag and by attributes, so insertion costs the tag's attributes and removal and lookup are constant. An attribute group leaves the index with its last entry, so the index does not grow with the distinct attribute sets of the input. Reported by Liyi Zhou, Ziyue Wang, Strick Sheng, Maurice Ng and Chenchen Yu (University of Sydney), and by Anthropic.
• e2901d06 High: 13–18 s from 300 KB, also through cheerio's .append(), .html() and $(). Moving a node's children (every parseFragment result out of its root, the adoption agency's furthest block) detached them one at a time from the front of the child list, quadratic in their number. The children are copied once, detached from the end and appended in order, and both bundled adapters check the last child before searching the list, as insertBefore already did; the adapter interface is unchanged. parseFragment of 100,000 <b></b>: 4.1 s → 45 ms. Reported by Anthropic.
• fcce48d0 High: the reported deep-nesting quadratic. Every search of the stack of open elements cost up to its depth per token: scope checks, list items, generic end tags, insertion-mode resets, end tags in foreign content, foster parenting and the adoption agency's up to eight passes per end tag. 391 KB of nested <div>s took 23.7 s, and 256 repetitions of <b>, 255 <span><div> pairs and 33 </b> took 17.2 s from 735 KB. Once 64 elements are open, the stack indexes them by tag and counts the special elements and scope boundaries at or below each, so every search is constant per token, and the adoption agency leaves a removed element's slot free instead of shifting the stack; the two documents take 39 ms and 104 ms. Stacks that never reach 64 elements are scanned as before; a stack that does keeps the index for the rest of the parse and pays for it on every push and pop (300 nested tables parse about 20% slower). Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina; the adoption-agency and foreign-content cases were found while reviewing this series.
• #​1922 High: quadratic tokenizer time from a tag with many attributes. The duplicate-attribute check compared every new name with every earlier one; tags with more than 64 attributes now use a set. Reported by SameerJS6 in #​1901.
• 53d1261c Medium: a script-stripping rewriter misses a script. When the parsed chunk was dropped between the two code points of a character reference, input after the reference was skipped: no tag events for it, while RewritingStream forwarded its raw bytes. The position is recomputed from the current buffer. Reported by Anthropic.
• 4bffbe64 Medium: a filter bypass once the output is embedded in a page. At EOF inside a tag, the pending text's source range covered the dropped tag, so RewritingStream forwarded an unfinished tag that no listener saw. The text now ends where the tag starts. Reported by Anthropic.
• e02abba4 Medium: XSS through the rewriter. RewritingStream#emitText chose raw output from lastStartTagName, so text after </script>, before <script> or in an SVG <style> was written unescaped and entity-encoded input became live markup. It now tracks inRawText from the tokenizer state. Reported by Joshua Rogers and by Anthropic.
• ac2f60d5 Medium: memory proportional to an uncapped stream. The streaming parsers kept a whole run of text as one pending token until a tag; memory grew with the stream. Completed text is flushed when a parsed chunk is dropped, with exact source ranges, in every state without an unfinished token, so a stream whose every chunk ends inside a CDATA ]], a named reference or an escaped-script < is flushed too and only the pending construct stays buffered. Reported by Liyi Zhou, Ziyue Wang, Strick Sheng, Maurice Ng and Chenchen Yu (University of Sydney); the chunks ending in a delimiter or reference were found while reviewing this series.
• fd22254c Medium: mutation XSS. The adoption agency acted on an older formatting element behind a scope boundary and moved the boundary element; the serialized tree re-parsed into an <img> absent from the input. It runs on the identified element. Reported by Anthropic.
• 61676e2b Medium, for consumers that inspect parse5's tree and forward the original bytes. Implied end tags popped foreign elements, so a </form> closed an SVG rp and parse5 read raw text where browsers see an <img onerror>. HTML elements only. Reported by Anthropic.
• b9093da5 Medium, same consumer pattern. Foreign end tags were matched with toLowerCase, which folds U+212A KELVIN SIGN to k; the wrong ancestors stayed open and parse5 hid an <img> browsers render. Matching is ASCII case-insensitive. Reported by Anthropic.
• 69f69313 Medium, same consumer pattern. In a fragment, an unmatched foreign end tag was dropped at the root instead of being processed with the HTML rules, so a </form> did not reset the form pointer and a later <form action=javascript:…> was missing from the fragment. Reported by Anthropic.
• d5f4f129 Medium, same consumer pattern. A fragment context's SVG form ancestor was taken as the form element pointer, suppressing the fragment's HTML form. Only an HTML form qualifies. Found while reviewing this series.
• 48aba8cb Low: a self-closing <svg/> or <math/> left its namespace frame in the SAX simulator, so a stream of such roots grew the frame stack without bound and following content was tokenized as foreign; integration-point end tags now close only the frame their element opened. Frames also follow tree construction for svg and math inside the other foreign namespace, mglyph and malignmark in a MathML text integration point, and </p> and </br>. Found while reviewing this series.
• f52fa37f Documentation. SECURITY.md now says that the current maintainers cannot see reports filed through GitHub's private vulnerability reporting, and that Tidelift is the only channel for reports.

Other changes

• docs: add usage examples for four parse5 packages by @​Sinkleberg in #​1878
• fix(plain-text): default to the standard tree adapter types by @​xiehuanyi in #​1883
• fix(parser-stream): require parse5 ^8.1.0 by @​scttcper in #​1916
• chore: v8.1.1 by @​fb55 in #​1926

New Contributors

• @​Sinkleberg made their first contribution in #​1878
• @​xiehuanyi made their first contribution in #​1883
• @​scttcper made their first contribution in #​1916

Packages

parse5 8.1.1, parse5-sax-parser 8.0.1, parse5-html-rewriting-stream 8.1.1, parse5-htmlparser2-tree-adapter 8.0.2, parse5-parser-stream 8.1.1, parse5-plain-text-conversion-stream 8.0.1. The dependent packages require the fixed parse5.

Full Changelog: inikulin/parse5@v8.1.0...v8.1.1

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	launchpad	d5865ff	Commit Preview URL Branch Preview URL	Nov 09 2026, 12:39 AM