CVE-2026-40986: Spring Web Flow JS RemotingHandler Renders Non-HTML Response as HTML
Summary
CVE-2026-40986: Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML. Affects org.springframework.webflow:spring-webflow across 3 version ranges.
< 2.5.1
>= 3.0.0, < 3.0.2
>= 4.0.0, < 4.0.1
Fixed in 2.5.1, 3.0.2 or 4.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Spring Web Flow is a framework that facilitates the development of web applications by managing the flow of control and state in a web application. It provides a robust way to define and manage user interactions, making it easier for developers to create complex web applications. However, certain versions of Spring Web Flow are vulnerable to a security issue that can lead to scripting attacks.
Vulnerability Detail
The vulnerability arises from the JavaScript RemotingHandler in Spring Web Flow, which incorrectly renders the body of an error response as HTML, even when the response type is not 'text/html'. This flaw can be exploited by attackers to inject malicious scripts into the response, which may then be executed in the user's browser, leading to potential data theft or unauthorized actions on behalf of the user.
How To Fix
Latest published version: 4.0.1 as of 23 Oct 2026
The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.12.5.1 -
>= 3.0.0, < 3.0.23.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on the server-side to prevent malicious scripts from being included in error responses. Additionally, ensure that your application does not expose sensitive error details to users.
Conclusion
The vulnerability identified as CVE-2026-40986 in Spring Web Flow poses a significant risk due to improper handling of error responses. It is crucial for developers using affected versions to update to the patched versions to safeguard against potential scripting attacks.
See every vulnerability recorded for org.springframework.webflow:spring-webflow →
FAQ
Affected versions include Spring Web Flow 4.0.0, 3.0.0 through 3.0.1, and 2.5.0 through 2.5.1.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
If exploited, this vulnerability can lead to scripting attacks, allowing attackers to execute malicious scripts in the user's browser, potentially compromising user data.
Yes, you can implement input validation and sanitization on the server-side to prevent malicious scripts from being included in error responses as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.webflow:spring-webflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
