DOMParser Manipulation Vulnerability in xmldom by xmldom

CVE-2026-83612

What is CVE-2026-83612?

The xmldom library, a JavaScript implementation of the W3C standard for the XML DOM, has a vulnerability affecting versions 0.9.0-beta.1 to 0.9.11. This flaw in the HTML-mode parsing leads to mishandling of mixed-case closing tags in elements such as script, style, textarea, and title. Specifically, when using DOMParser.parseFromString(), a case-sensitive index check for these elements can result in a missed closing tag, causing the parser to enter an unstable state. This instability may lead to disproportionately high consumption of CPU and memory resources during the processing of small untrusted text/html documents. Users are advised to update to version 0.9.12 or later to mitigate this issue.

References