Denial of Service Vulnerability in xmldom JavaScript Library
CVE-2026-83614
What is CVE-2026-83614?
The xmldom library, a JavaScript module implementing the W3C standard for XML parsing and serialization, contains vulnerabilities that can lead to denial of service. Specifically, in versions prior to @xmldom/xmldom 0.8.15 and 0.9.12, two distinct paths can be exploited. The first path arises from issues in lib/sax.js, where the method parseElementStartPart may get into an endless cycle when handling malformed tag names, thereby consuming excessive resources. The second path is found in lib/dom.js where the normalize() function may lead to repeated removal and re-adding of adjacent text nodes, causing significant performance degradation due to quadratic reindexing. Both vulnerabilities can be triggered through default parsing methods, necessitating immediate updates to the latest versions to safeguard against these issues.
Affected Version(s)
xmldom >= 0.3.0, <= 0.6.0
xmldom >= 0.7.0, < 0.8.15 < 0.7.0, 0.8.15
xmldom >= 0.9.0, < 0.9.12 < 0.9.0, 0.9.12