Denial of Service Vulnerability in xmldom's DOMParser and XMLSerializer Module

CVE-2026-83606

What is CVE-2026-83606?

The xmldom library, which provides a JavaScript implementation of the W3C XML DOM Level 2 Core, contains a vulnerability between versions 0.9.0-beta.9 and 0.9.10. This issue arises from the lib/grammar.js parsing logic, where a missing closing tag leads to inefficient handling of whitespace and characters, resulting in excessive backtracking during XML parsing. This backtracking can potentially disrupt the Node.js event loop, causing a denial of service. Users are encouraged to update to version 0.9.11, where this issue has been resolved.

References