CVE-2026-83619
Received Received - Intake

ReDoS Vulnerability in xmldom JavaScript Parser

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression /[ \t\n\r]+$/g. For an end tag containing a long whitespace run followed by a non-whitespace character, the expression retries from each possible starting position and backtracks quadratically before failing its end anchor. DOMParser.parseFromString() reaches the path under default options, allowing a small unauthenticated XML input to stall the Node.js event loop; the 0.9.x and unscoped npm lines do not contain this expression. This issue is fixed in @xmldom/xmldom version 0.8.15.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83619
EUVD
EUVD-2026-69248

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
xmldom xmldom to 0.8.14 (inc)
xmldom xmldom 0.9.*
xmldom xmldom 0.8.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a ReDoS (Regular Expression Denial of Service) vulnerability in the xmldom library affecting versions 0.7.0 to 0.8.14. It occurs when parsing XML end tags with long trailing whitespace followed by a non-whitespace character. The parser uses an unanchored regex that causes quadratic backtracking, stalling the Node.js event loop for seconds with small inputs.

Detection Guidance

To detect this vulnerability, check if your system uses xmldom versions 0.7.0 to 0.8.14. Run: npm list xmldom or npm list @xmldom/xmldom. If vulnerable versions are installed, update to 0.8.15 or later.

Impact Analysis

An attacker can send a small malicious XML input to a server using the vulnerable xmldom library, causing the server's event loop to stall for seconds. This results in degraded performance or complete unavailability of the service, effectively a denial of service attack.

Mitigation Strategies

Immediately update xmldom to version 0.8.15 or later. If using the 0.9.x line, no action is needed as it is unaffected. Monitor for unusual CPU usage spikes during XML parsing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83619. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart