- Hugo v0.168.0 is built with Go 1.27.2, which includes 15 security fixes, and it upgrades several libraries Hugo depends on.
- The release also makes Hugo ignore module.replacements set by themes, so only the project itself can swap dependencies.
- Teams running Hugo should check which version their build pipeline uses and whether any theme relies on replacements.
A static website looks simple. It is a folder of finished pages with no database to attack. But the pages are produced by a build tool, and that tool stands on a compiler, libraries and themes written by other people. Hugo v0.168.0 shows where a static site's risk actually sits: in the layers underneath it.
What the release contains
The Hugo project published v0.168.0 on GitHub on October 13. The security content comes mostly from upgrades, not from new Hugo code. The maintainers compiled this version with Go 1.27.2, a Go update that carries 15 security patches.
Two dependencies moved as well. Hugo's networking package, golang.org/x/net, went from v0.59.0 to v0.61.0. The page-shrinking library tdewolff/minify went from v2.24.17 to v2.24.19.
The release notes pick out the fixes most relevant to Hugo. Each one touches a different part of how a site is built or served.
How the fixes work
Hugo fills pages with content using Go's html/template package. That package escapes text so it cannot be read as code. It has to know whether it is inside HTML, a script or a pattern. If it loses track, escaping goes wrong.
Two fixes address this. CVE-2026-94448 covers context tracking that was not reset on consecutive expressions in JavaScript template literals. CVE-2026-97030 covers the keyword yield not being recognised as something that can precede a regular expression. According to the release notes, either flaw could lead to incorrect escaping of inline JavaScript. Both also apply to Hugo's own fork of the package.
A third fix sits in the minifier, which shrinks pages. Before the upgrade, </script> and <!-- inside inline scripts were not escaped properly when minifying JavaScript in HTML. Variants in a different letter case were also not escaped. It is tracked as GHSA-3ppm-p7r9-c5w3.
Several net/http fixes cover an HTTP/2 server crash, memory exhaustion, connection desynchronization and unbounded Range header parsing. The notes call these relevant for hugo server and remote resources. That points to where exposure matters: the built-in preview server and anything the build fetches from outside. A separate fix, CVE-2026-56857, covers os.Root.Mkdir(All) following junctions out of its root on Windows.
The change that limits themes
The least technical change may matter most to a manager. Themes can no longer redirect a dependency. If one carries a module.replacements setting, Hugo now skips it. That power rests with the project alone.
A replacement tells the build to use a different source for a dependency. Before this change, a theme could set one. After it, the site owner alone decides. The release notes do not say why the change was made, and they do not report any abuse. The effect is still clear. A theme is code from a third party, and it no longer gets a say over what else your build pulls in.
A smaller change points the same way. Suppose an animated image has so many frames that handling them all would pass the memory cap of Hugo's WASM runtime. The build now stops early with a descriptive error. There is also a new imaging.firstFrameOnly option. The notes do not frame these as security fixes. They do mean a heavy image can stop a build with a clear message.
What the numbers say, and do not say
WebPulse's NVD-based profile for Hugo, CPE-matched, lists 16 CVEs in total. Fifteen fall in the last 12 months. None is rated critical and none is in the CISA Known Exploited Vulnerabilities catalog.
That figure of 15 is unrelated to the 15 security fixes in Go 1.27.2. The two numbers match by coincidence. The profile also does not say which CVEs sit in Hugo's own code, so treat it as context and not a verdict.
What to ask your team
The lesson here is that a static site moves risk from the server to the build. Patching the running site is not enough. The build tool and its inputs need an owner.
Put these questions to whoever runs your site:
First, which Hugo version does our build pipeline use, and who updates it? Second, does any theme we use set module.replacements, and will the site still build once Hugo ignores them? Third, is hugo server ever reachable beyond a developer's machine? Fourth, which remote resources does our build fetch, and from where?
A site with no database still has a supply chain. This release is a reminder to treat the build as part of what you secure.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: GitHub (gohugoio/hugo).
