CVE-2026-83613
Received Received - Intake

ReDoS in xmldom via Quadratic Attribute Parsing

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode, while NamedNodeMap.setNamedItem in lib/dom.js calls the linear getNamedItem or getNamedItemNS lookup for each insertion. A well-formed element with many distinct attributes therefore requires quadratic comparisons during DOMParser.parseFromString() and can stall a Node.js event loop before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83613
EUVD
EUVD-2026-69231

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
xmldom xmldom to 0.8.15|end_excluding=0.9.12|end_excluding=0.6.0 (exc)
@xmldom xmldom to 0.8.15|end_excluding=0.9.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the xmldom library, which is used for parsing and serializing XML in JavaScript. The issue occurs when parsing XML with many attributes. The DOMHandler.startElement function inserts each attribute using setAttributeNode, while NamedNodeMap.setNamedItem performs a linear search for each insertion. This leads to quadratic time complexity, causing significant delays during parsing and potentially stalling the Node.js event loop.

Detection Guidance

This vulnerability is specific to the xmldom library in JavaScript applications. To detect it, check if your project uses xmldom versions prior to 0.8.15 or 0.9.12. Run commands like 'npm list xmldom' or 'npm list @xmldom/xmldom' in your project directory to identify the installed version.

Impact Analysis

If you use a vulnerable version of xmldom in a Node.js application, an attacker could craft XML with many attributes to cause a denial of service by consuming excessive CPU resources and blocking the event loop. This may lead to unresponsive applications or crashes.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions due to excessive CPU consumption during XML parsing. It does not directly affect data confidentiality or integrity but may impact system availability, which could indirectly affect compliance with standards like GDPR or HIPAA that require timely access to personal or health data.

Mitigation Strategies

Upgrade to the latest patched versions of xmldom: @xmldom/xmldom 0.8.15 or 0.9.12. If using xmldom 0.6.0 or earlier, migrate to @xmldom/xmldom. Update dependencies in your package.json and run 'npm install' to apply changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83613. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart