CVE-2026-83618
HighCVSS 8.7Summary
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.10 to 0.9.12, validation of DocumentType.publicId and systemId using expressions with the multiline flag allows bypassing validation and injecting markup into the <!DOCTYPE> declaration. This issue is fixed in version 0.9.12.
Risk Assessment
The vulnerability allows XML injection, potentially leading to unauthorized modification of XML documents or XXE attacks if data is processed unsafely.
Recommendation
It is recommended to upgrade @xmldom/xmldom to version 0.9.12 or later, which contains the fix.
Other vulnerabilities in @xmldom/xmldom
See all- CVE-2026-83619High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.7.0 to 0.8.15, the parser in lib/sax.js uses an unanchored global expression to trim end-tag names, leading to quadratic backtracking on long whitespace runs. A small unauthenticated XML document can stall the Node.js event loop. This issue is fixed in version 0.8.15.
- CVE-2026-83617High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.11 to 0.9.12, element and attribute name checks using the QName_exact expression with the multiline flag allow bypassing validation and injecting markup into element or attribute names. This issue is fixed in version 0.9.12.
- CVE-2026-83616High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, Document.createProcessingInstruction() accepts an unvalidated target, allowing XML structure injection by breaking the processing-instruction boundary. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.
- CVE-2026-83615High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.1.5-0.6.0, appendElement in lib/sax.js clones the entire namespace map for each nested element, leading to quadratic memory usage. A small XML document can exhaust the process heap. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.
- CVE-2026-83614High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.3.0-0.6.0, two independent quadratic paths can cause denial of service: parseElementStartPart repeatedly rescans a malformed tag name, and normalize() repeatedly removes and appends adjacent text nodes. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.
- CVE-2026-83613High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, DOMHandler.startElement inserts every attribute through setAttributeNode, and NamedNodeMap.setNamedItem performs a linear lookup, leading to quadratic complexity with many attributes. A small XML document can stall the Node.js event loop. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.
- CVE-2026-83612High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.0-beta.1 to 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles mixed-case closing tags for script, style, textarea, and title elements. This leads to unstable parser progression and quadratic output amplification. A small text/html document can consume disproportionate CPU and memory. This issue is fixed in version 0.9.12.
- CVE-2026-41675High
The @xmldom/xmldom library before versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier fail to validate processing instruction data, allowing an attacker to inject the closing sequence ?> and add arbitrary XML nodes to the resulting document.
- CVE-2026-41673High
In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application.
Original NVD description (English source)
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteral_match and SystemLiteral_match expressions produced by reg() in lib/grammar.js, which inherit the multiline flag. A complete valid literal on the first line can therefore satisfy the matcher while U+000A, U+000D, U+2028, or U+2029 and breakout markup remain in the emitted <!DOCTYPE ...> declaration. This bypasses the strict-serialization mitigation for the earlier DocumentType injection advisory; creation and direct property assignment remain unvalidated by design. This issue is fixed in @xmldom/xmldom version 0.9.12.