AZL-112115: CVE-2026-78661 affecting package packer 1.9.5-23
Published Oct 27, 2026
·Updated
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
Affected Software
1 affected component
azure-linux/packer<=1.9.5-23
Event History
Oct 27, 2026
Advisory Published
via OSV·10:18 PM
Data Sourced
via OSV·10:18 PM
DescriptionAffected Software