CVE-2026-83615
Received Received - Intake

Memory Exhaustion in xmldom via Namespace Map Cloning

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses _copy to clone the complete currentNSMap for each nested element that declares a new namespace prefix. Keeping every ancestor map live on the parse stack creates quadratic peak namespace-map storage, so a small highly compressible XML document can exhaust the process heap before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83615
EUVD
EUVD-2026-69236

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
xmldom xmldom From 0.1.5 (inc) to 0.6.0 (inc)
@xmldom xmldom to 0.9.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the xmldom library, which is used for parsing and serializing XML in JavaScript. The issue is in the appendElement function in lib/sax.js, which creates excessive memory usage by storing namespace maps for each nested element. This can lead to a denial of service by exhausting the process heap.

Detection Guidance

To detect this vulnerability, check if your system uses vulnerable versions of xmldom (0.1.5 to 0.6.0 or 0.7.0 to 0.8.14 and 0.9.0 to 0.9.11). Run commands like 'npm list xmldom' or 'npm list @xmldom/xmldom' to check installed versions. If vulnerable, update to patched versions (0.8.15 or 0.9.12).

Impact Analysis

If you use a vulnerable version of xmldom, an attacker could send a specially crafted XML document that causes the application to consume excessive memory, leading to crashes or degraded performance. This could disrupt services relying on XML processing.

Compliance Impact

This vulnerability primarily causes a denial-of-service due to excessive memory consumption, which could disrupt services handling XML data. While not directly violating GDPR or HIPAA, it may indirectly impact compliance by failing to ensure availability of systems processing personal or health data, as required by these regulations.

Mitigation Strategies

Update to @xmldom/xmldom versions 0.8.15 or 0.9.12 or later. If using xmldom versions 0.1.5 through 0.6.0, migrate to a supported version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83615. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart