NPM · SEPTEMBER 2026 · EARLY WARNING

SWC HTML Minifier Vulnerability: Script Element Breakout Risk

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
@swc/html (npm)
Affected versions
< 1.15.47-nightly-20260729.1
Patched version
1.15.47
GHSA-5QR2-V392-M9G8

An early warning has been issued regarding a potential vulnerability in the @swc/html npm package that may allow script element breakout when minifying embedded JSON. This could potentially transform inert data into active markup.

What happened

An early warning has been issued for a potential vulnerability in the @swc/html npm package. The issue reportedly allows script element breakout when minifying embedded JSON, which could transform inert data into active markup. This could allow a crafted payload to execute script in the origin of the generated page. The vulnerability is under investigation and has not yet been confirmed as exploited in the wild.

The affected components include @swc/html (npm) for versions less than 1.15.47-nightly-20260729.1 and swc_html_minifier (npm) for versions less than 59.0.0. The recommended patched versions are @swc/html@1.15.47 and swc_html_minifier@59.0.0. If upgrading is not possible, it is recommended to disable JSON minification.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If @swc/html is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You may be affected if you are using @swc/html (npm) for versions less than 1.15.47-nightly-20260729.1 or swc_html_minifier (npm) for versions less than 59.0.0.

What should I do right now?

Upgrade to @swc/html@1.15.47 or swc_html_minifier@59.0.0. If upgrading is not possible, disable JSON minification.

What is the current status of this vulnerability?

This is an early warning and the vulnerability is under investigation. It has not yet been confirmed as exploited in the wild.

Sources

Join the 0Day waitlist →

← Back to all threats