CVE-2026-83612
Received Received - Intake

DOMParser HTML Parsing Quadratic Amplification in xmldom

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result of negative one, causing unstable parser progression and quadratic output amplification. A small untrusted text/html document can consequently consume disproportionate CPU and memory when parsed and serialized. This issue is fixed in @xmldom/xmldom version 0.9.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83612
EUVD
EUVD-2026-69227

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
xmldom xmldom From 0.9.0-beta.1 (inc) to 0.9.12 (exc)
xmldom xmldom 0.9.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the xmldom library, a JavaScript module for parsing and serializing XML/HTML. When parsing HTML in versions 0.9.0-beta.1 to 0.9.12, a flaw in handling mixed-case closing tags for script, style, textarea, or title elements causes the parser to malfunction. It uses case-sensitive checks and incorrect substring operations, leading to unstable parsing and excessive CPU/memory usage during processing of untrusted HTML documents.

Detection Guidance

This vulnerability affects the xmldom library versions between 0.9.0-beta.1 and 0.9.12. To detect it, check if your system uses a vulnerable version of xmldom by running: npm list xmldom or grep -r 'xmldom' in your project files. If the version is within the affected range, the system is vulnerable.

Impact Analysis

If you use the affected xmldom versions, an attacker could craft a malicious HTML document that, when parsed, consumes excessive system resources. This may cause performance degradation, application slowdowns, or even denial-of-service conditions on your system due to high CPU and memory usage.

Compliance Impact

This vulnerability primarily impacts system availability due to resource exhaustion, which could lead to service disruptions. While not directly violating GDPR or HIPAA, prolonged downtime may affect data processing timelines or access controls, potentially impacting compliance with availability requirements under these regulations.

Mitigation Strategies

Upgrade the xmldom library to version 0.9.12 or later immediately. Use npm update xmldom or manually update the dependency in your package.json file. If upgrading is not possible, consider removing or replacing the library with a non-vulnerable alternative.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83612. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart