DOM Parsing Vulnerability in xmldom JavaScript Module
CVE-2026-83611
What is CVE-2026-83611?
The xmldom module, which implements the W3C standard XML DOM Level 2 Core, contains a vulnerability in its DOMParser.parseFromString() method. Versions prior to 0.8.15 for @xmldom/xmldom and version 0.6.0 for xmldom allows the parser to improperly process end tags, resulting in the potential for undesirable parsing behavior. Specifically, the parser can accept malformed end tags that lead to the premature closure of elements, discarding trailing content without alerting the user. While this does not result in content injection, it undermines the integrity of XML parsing, making it essential to update to fixed versions to ensure reliable data handling.
Affected Version(s)
xmldom <= 0.6.0
xmldom >= 0.9.0, < 0.9.12 < 0.9.0, 0.9.12
xmldom >= 0.7.0, < 0.8.15 < 0.7.0, 0.8.15