CVE-2026-40986: Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

June 11, 2026 (updated August 18, 2026)

Spring Web Flow’s JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not “text/html”, which can result in a scripting attack in the user’s browser if the error response from the server contains error details with input reflected from an attacker.

Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.

References

github.com/advisories/GHSA-hw5c-xm3c-v96w
nvd.nist.gov/vuln/detail/CVE-2026-40986
spring.io/security/cve-2026-40986

Code Behaviors & Features

Detect and mitigate CVE-2026-40986 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →