Riskcovery

CVE-2026-83614

xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

State
Published
Severity
8.7 High
Published
Sep 1, 2026
Updated
Sep 1, 2026
Reserved
Aug 31, 2026

Read the record on cve.org

Description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically constructed DOM, and endDocument invokes that normalization after parsing. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NGitHub_M

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption
  • CWE-407 Inefficient Algorithmic Complexity

Affected Products

ProductVersions
xmldomxmldom
  • >= 0.3.0, <= 0.6.0Affected
xmldom@xmldom
  • >= 0.7.0, < 0.8.15Affected
  • >= 0.9.0, < 0.9.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.