XML DOMParser and XMLSerializer Module Vulnerability in xmldom
CVE-2026-83613
8.7HIGH
What is CVE-2026-83613?
The xmldom package, a pure JavaScript implementation of W3C's XML DOM Level 2, has a vulnerability in its DOM parsing mechanism. In versions prior to @xmldom/xmldom 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, the DOMHandler.startElement method inefficiently processes attributes through setAttributeNode, which can lead to excessive resource consumption and potential stalling of the Node.js event loop during the parsing of elements with many unique attributes. This issue can adversely affect application performance and reliability, particularly in contexts handling large amounts of XML data.
Affected Version(s)
xmldom <= 0.6.0
xmldom >= 0.9.0, < 0.9.12 < 0.9.0, 0.9.12
xmldom >= 0.7.0, < 0.8.15 < 0.7.0, 0.8.15