CVE-2026-83614
HighCVSS 8.7Summary
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.3.0-0.6.0, two independent quadratic paths can cause denial of service: parseElementStartPart repeatedly rescans a malformed tag name, and normalize() repeatedly removes and appends adjacent text nodes. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.
Risk Assessment
An attacker can cause a denial of service (DoS) by sending a small XML document that stalls the Node.js event loop or causes excessive CPU/memory usage.
Recommendation
It is recommended to upgrade @xmldom/xmldom to version 0.8.15 or 0.9.12; if using xmldom, consider migrating to @xmldom/xmldom.
Other vulnerabilities in @xmldom/xmldom
See all- CVE-2026-83619High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.7.0 to 0.8.15, the parser in lib/sax.js uses an unanchored global expression to trim end-tag names, leading to quadratic backtracking on long whitespace runs. A small unauthenticated XML document can stall the Node.js event loop. This issue is fixed in version 0.8.15.
- CVE-2026-83618High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.10 to 0.9.12, validation of DocumentType.publicId and systemId using expressions with the multiline flag allows bypassing validation and injecting markup into the <!DOCTYPE> declaration. This issue is fixed in version 0.9.12.
- CVE-2026-83617High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.11 to 0.9.12, element and attribute name checks using the QName_exact expression with the multiline flag allow bypassing validation and injecting markup into element or attribute names. This issue is fixed in version 0.9.12.
- CVE-2026-83616High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, Document.createProcessingInstruction() accepts an unvalidated target, allowing XML structure injection by breaking the processing-instruction boundary. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.
- CVE-2026-83615High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.1.5-0.6.0, appendElement in lib/sax.js clones the entire namespace map for each nested element, leading to quadratic memory usage. A small XML document can exhaust the process heap. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.
- CVE-2026-83613High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, DOMHandler.startElement inserts every attribute through setAttributeNode, and NamedNodeMap.setNamedItem performs a linear lookup, leading to quadratic complexity with many attributes. A small XML document can stall the Node.js event loop. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.
- CVE-2026-83612High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.0-beta.1 to 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles mixed-case closing tags for script, style, textarea, and title elements. This leads to unstable parser progression and quadratic output amplification. A small text/html document can consume disproportionate CPU and memory. This issue is fixed in version 0.9.12.
- CVE-2026-41675High
The @xmldom/xmldom library before versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier fail to validate processing instruction data, allowing an attacker to inject the closing sequence ?> and add arbitrary XML nodes to the resulting document.
- CVE-2026-41673High
In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application.
Original NVD description (English source)
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically constructed DOM, and endDocument invokes that normalization after parsing. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.