CVE-2026-72925

## Impact `@swc/html` minifies JSON contained in `script` elements such as `application/json` and `application/ld+json` by parsing and serializing the JSON value. Before the patched versions, JSON serialization could convert escaped less-than signs such as `\u003C` into literal `<` characters. If the JSON contained an escaped `</script>` sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed. Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page. ## Patches The issue is fixed in: - `@swc/html` 1.15.47 - `swc_html_minifier` 59.0.0 The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary. ## Workarounds Users who cannot upgrade can disable JSON minification with: ```js await minify(html, { minifyJson: false, });