Common Weakness Enumeration

    CWE Definition / CWE-86

    CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages

    The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

    Published:19 Jul 2006
    Organization:MITRE
    Modified:11 Dec 2025

    Related Weakness

    CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    CWE-184: Incomplete List of Disallowed Inputs

    CWE-436: Interpretation Conflict