Vulnerability · Published Sep 1, 2026 · Assigned by GitHub_M

CVE-2026-83619xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

High 8.7

In plain English

A high-severity uncontrolled resource consumption in xmldom from xmldom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 55.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression /[ \t\n\r]+$/g. For an end tag containing a long whitespace run followed by a non-whitespace character, the expression retries from each possible starting position and backtracks quadratically before failing its end anchor. DOMParser.parseFromString() reaches the path under default options, allowing a small unauthenticated XML input to stall the Node.js event loop; the 0.9.x and unscoped npm lines do not contain this expression. This issue is fixed in @xmldom/xmldom version 0.8.15.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-xmldom	no fix listed	DEBIAN-CVE-2026-83619
Debian:13	node-xmldom	0.9.5-1	DEBIAN-CVE-2026-83619
Debian:14	node-xmldom	0.9.5-1	DEBIAN-CVE-2026-83619
Ubuntu:22.04:LTS	node-xmldom	no fix listed	UBUNTU-CVE-2026-83619
Ubuntu:24.04:LTS	node-xmldom	no fix listed	UBUNTU-CVE-2026-83619
npm	@xmldom/xmldom	0.8.15	GHSA-x4fp-j954-r2f4

Affected products (as reported)

Vendor	Product	Versions
xmldom	xmldom	>= 0.7.0, < 0.8.15
@xmldom	xmldom	>= 0.7.0, < 0.8.15

Weakness: CWE-400, CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4 x_refsource_CONFIRM
https://github.com/xmldom/xmldom/pull/1072 x_refsource_MISC
https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09 x_refsource_MISC
https://github.com/xmldom/xmldom/releases/tag/0.8.15 x_refsource_MISC