HeroDevs
Visit NES for HtmlUnit Home Page

NES for HtmlUnit 2.60.x Release Notes

3 versions

Comprehensive release notes and changelog for NES for HtmlUnit 2.60.x, including security patches, bug fixes, and feature updates across all supported versions.

Nov 5, 2026
Latest: 2.60.3
8 Patched Vulnerabilities
VEX Statements

November 2026

2.60.3

Released Nov 5, 2026
CVE-2023-2798
CVE-2023-49093
Full Version: 
2.60.0-htmlunit-2.60.3

Security Fixes

  • DomNode no longer recurses once per ancestor when it notifies DOM change and character data listeners or iterates descendant elements, so a deeply nested document can no longer exhaust the stack with a StackOverflowError (CVE-2023-2798).
  • XSLProcessor.transform() in the MSXML ActiveX emulation no longer lets a stylesheet call Java extension functions such as java.lang.Runtime methods (CVE-2023-49093).

September 2026

2.60.2

Released Sep 11, 2026
CVE-2023-26119
CVE-2022-34169
CVE-2022-42889
CVE-2024-47554
CVE-2021-37533
1 More
Full Version: 
2.60.0-htmlunit-2.60.2

Security Fixes

  • The JavaScript XSLTProcessor now enables secure processing, so a stylesheet can no longer call Java extension functions such as java.lang.Runtime methods (CVE-2023-26119).

Dependency Upgrades

July 2026

2.60.1

Released Jul 23, 2026
Full Version: 
2.60.0-htmlunit-2.60.1

Notes

  • This release originates from the open-source HtmlUnit project forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.
  • This is the initial supported baseline for the 2.60.x line. It is functionally identical to upstream 2.60.0, with no behavioral changes, and contains no vulnerability patches. Security fixes are delivered in subsequent releases on this line.

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.