CVE-2026-83614
Received Received - Intake

Denial of Service in xmldom JavaScript Library

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically constructed DOM, and endDocument invokes that normalization after parsing. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83614
EUVD
EUVD-2026-69234

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
@xmldom xmldom 0.8.15
@xmldom xmldom 0.9.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the xmldom library involves two quadratic-time performance issues that can cause denial-of-service conditions. The first issue occurs when parsing malformed XML tags with many '<' characters, causing the parser to repeatedly scan forward to find a closing '>', resulting in O(n²) time complexity. The second issue involves the normalize() method inefficiently merging adjacent text nodes, also leading to O(n²) time complexity for long runs of text nodes.

Detection Guidance

Detecting this vulnerability requires checking if your system uses a vulnerable version of xmldom. Run 'npm list xmldom' or 'npm list @xmldom/xmldom' to check installed versions. If versions are between 0.3.0-0.6.0 or 0.7.0-0.8.14 and 0.9.0-0.9.11, the system is vulnerable.

Impact Analysis

This vulnerability can impact you by causing your application to slow down or become unresponsive when processing specially crafted XML input. This could lead to denial-of-service conditions, where your system may hang or crash due to excessive CPU usage during XML parsing or DOM manipulation.

Mitigation Strategies

Upgrade xmldom to versions 0.8.15 or 0.9.12 for @xmldom/xmldom. If using the unscoped xmldom package, upgrade to a fixed version if available. Otherwise, consider migrating to a different XML parser library.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83614. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart