Log in Start free

Vulnerability · Published Sep 1, 2026 · Assigned by GitHub_M

CVE-2026-83614xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

High 8.7

In plain English

A high-severity uncontrolled resource consumption in xmldom from xmldom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.6%top 51.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically constructed DOM, and endDocument invokes that normalization after parsing. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-xmldomno fix listedDEBIAN-CVE-2026-83614
Debian:13node-xmldomno fix listedDEBIAN-CVE-2026-83614
Debian:14node-xmldom0.9.12-1DEBIAN-CVE-2026-83614
Ubuntu:22.04:LTSnode-xmldomno fix listedUBUNTU-CVE-2026-83614
Ubuntu:24.04:LTSnode-xmldomno fix listedUBUNTU-CVE-2026-83614
Ubuntu:26.04:LTSnode-xmldomno fix listedUBUNTU-CVE-2026-83614
Ubuntu:26.10node-xmldomno fix listedUBUNTU-CVE-2026-83614
npm@xmldom/xmldom0.8.15GHSA-93r5-fhx6-vmg9
npm@xmldom/xmldom0.9.12GHSA-93r5-fhx6-vmg9
npmxmldomno fix listedGHSA-93r5-fhx6-vmg9

Affected products (as reported)

VendorProductVersions
xmldom xmldom >= 0.3.0, <= 0.6.0
@xmldom xmldom >= 0.7.0, < 0.8.15>= 0.9.0, < 0.9.12

Weakness: CWE-400, CWE-407 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References