News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-97030 CVE Medium False Positive

html/template: Incorrect Regexp Escaping After yield Keyword

This advisory does not affect KrakenD

KrakenD is an API gateway and does not use html/template to render HTML output anywhere in its request path, so the escaper is never reached.

Addressed through routine dependency maintenance in CE 3.0.1 and EE 3.0.1, 2.13.11.

Component

Go standard library (html/template)

Disclosed

Oct 13, 2026

Description

Go’s html/template did not recognize yield as a keyword that can precede a JavaScript regexp literal. In a valid template, a regexp following yield was escaped as if it were a division, which can lead to cross-site scripting in pages rendered from such templates. This does not affect KrakenD.

References

View CVE-2026-97030 on Go Issue Tracker View CVE-2026-97030 on Go Vulnerability Database

Stay up to date with KrakenD releases and important updates