CVE-2026-83619
HighCVSS 8.7Summary
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.7.0 to 0.8.15, the parser in lib/sax.js uses an unanchored global expression to trim end-tag names, leading to quadratic backtracking on long whitespace runs. A small unauthenticated XML document can stall the Node.js event loop. This issue is fixed in version 0.8.15.
Risk Assessment
An attacker can cause a denial of service (DoS) by sending a small XML document that stalls the Node.js application, potentially affecting service availability.
Recommendation
It is recommended to upgrade @xmldom/xmldom to version 0.8.15 or later, which contains the fix.
Other vulnerabilities in @xmldom/xmldom
See all- CVE-2026-83618High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.10 to 0.9.12, validation of DocumentType.publicId and systemId using expressions with the multiline flag allows bypassing validation and injecting markup into the <!DOCTYPE> declaration. This issue is fixed in version 0.9.12.
- CVE-2026-83617High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.11 to 0.9.12, element and attribute name checks using the QName_exact expression with the multiline flag allow bypassing validation and injecting markup into element or attribute names. This issue is fixed in version 0.9.12.
- CVE-2026-83616High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, Document.createProcessingInstruction() accepts an unvalidated target, allowing XML structure injection by breaking the processing-instruction boundary. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.
- CVE-2026-83615High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.1.5-0.6.0, appendElement in lib/sax.js clones the entire namespace map for each nested element, leading to quadratic memory usage. A small XML document can exhaust the process heap. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.
- CVE-2026-83614High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.3.0-0.6.0, two independent quadratic paths can cause denial of service: parseElementStartPart repeatedly rescans a malformed tag name, and normalize() repeatedly removes and appends adjacent text nodes. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.
- CVE-2026-83613High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, DOMHandler.startElement inserts every attribute through setAttributeNode, and NamedNodeMap.setNamedItem performs a linear lookup, leading to quadratic complexity with many attributes. A small XML document can stall the Node.js event loop. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.
- CVE-2026-83612High
xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.0-beta.1 to 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles mixed-case closing tags for script, style, textarea, and title elements. This leads to unstable parser progression and quadratic output amplification. A small text/html document can consume disproportionate CPU and memory. This issue is fixed in version 0.9.12.
- CVE-2026-41675High
The @xmldom/xmldom library before versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier fail to validate processing instruction data, allowing an attacker to inject the closing sequence ?> and add arbitrary XML nodes to the resulting document.
- CVE-2026-41673High
In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application.
Original NVD description (English source)
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression /[ \t\n\r]+$/g. For an end tag containing a long whitespace run followed by a non-whitespace character, the expression retries from each possible starting position and backtracks quadratically before failing its end anchor. DOMParser.parseFromString() reaches the path under default options, allowing a small unauthenticated XML input to stall the Node.js event loop; the 0.9.x and unscoped npm lines do not contain this expression. This issue is fixed in @xmldom/xmldom version 0.8.15.