Author

Yagiz Nizipli <ynizipli@cloudflare.com> 2026-02-26 00:00:00 +0000

Parents

bea11e5

Tree

2a21ba0

Fix HTMLRewriter AttributesIterator UAF on attribute mutation

When element attributes are modified during iteration (via setAttribute
or removeAttribute), lol-html's internal Vec may reallocate or shift
elements, leaving the iterator's pointers dangling. Continuing to
iterate would be a use-after-free (VULN-122672).

Invalidate all live AttributesIterator instances whenever setAttribute()
or removeAttribute() is called, and throw a clear error on subsequent
next() calls. Fresh iterators created after mutation work normally.