News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-94448 CVE Medium False Positive

html/template: Incorrect Escaping After Consecutive Template Literal Expressions

This advisory does not affect KrakenD

KrakenD is an API gateway and does not use html/template to render HTML output anywhere in its request path, so the escaper is never reached.

Addressed through routine dependency maintenance in CE 3.0.1 and EE 3.0.1, 2.13.11.

Component

Go standard library (html/template)

Disclosed

Oct 13, 2026

Description

Go’s html/template did not reset its context tracking between consecutive ${} expressions inside a JavaScript template literal. A regexp literal that followed could be misclassified and escaped incorrectly, which can lead to cross-site scripting in pages rendered from such templates. This does not affect KrakenD.

References

View CVE-2026-94448 on Go Issue Tracker View CVE-2026-94448 on Go Vulnerability Database

Stay up to date with KrakenD releases and important updates