News KrakenD CE 2.13.9 and EE 2.13.7 update released

CVE-2026-56858 Medium False Positive

html/template: XSS via Early Unescaped Slash Closure

This CVE does not affect KrakenD

KrakenD is an API gateway that proxies and transforms JSON/XML/gRPC traffic; it does not use html/template to render HTML output anywhere in its request path, so the vulnerable escaping logic is never invoked.

Addressed through routine dependency maintenance in CE 2.13.9 and EE 2.13.7.

Component

Go standard library (html/template)

Disclosed

Aug 14, 2026

Description

Go’s html/template package could be tricked by pathological input into closing an unescaped / earlier than intended inside a JavaScript regexp literal context, letting attacker-controlled data inject arbitrary script content. This could lead to cross-site scripting in applications that render untrusted data through html/template. The fix corrects the escaper’s tracking of JavaScript regexp context. This does not affect KrakenD, which never renders HTML templates.

References

View CVE-2026-56858 on NVD

Stay up to date with KrakenD releases and important updates