XML Parser Vulnerability in xmldom Affecting JavaScript Applications
CVE-2026-83619
8.7HIGH
What is CVE-2026-83619?
The xmldom library, which is a JavaScript XML DOM implementation, has a vulnerability found in its parser. Specifically, versions from 0.7.0 to 0.8.15 contain an issue in the lib/sax.js file, where an unanchored global regular expression incorrectly processes end-tag names. This flaw allows unauthenticated XML input to stall the Node.js event loop, potentially leading to denial-of-service situations. The issue has been remedied in version 0.8.15 and later, making it critical for users to upgrade their libraries to ensure application stability and security.
Affected Version(s)
xmldom >= 0.7.0, < 0.8.15
xmldom >= 0.7.0, < 0.8.15