Xmldom bug can overwhelm HTML-processing services

Published September 8, 2026 CVE-2026-83612

A small, specially prepared HTML document can make xmldom consume excessive memory and processing power. Affected services may slow down, time out, or stop answering.

Severity
HighCVSS 4.0 · 8.7
Fix
Fixed in 0.9.12
Affected versions
0.9.0-beta.1 or newer, but before 0.9.12
Weakness
CWE-178
Exploit likelihood
0.30% in 30 daysEPSS, higher than 23% of known flaws
Affects
xmldom

How it works

  • The service must use xmldom's HTML mode to read attacker-controlled HTML and turn it back into text.
  • The attacker uses closing labels with different capitalization from their opening labels. xmldom mistakes those labels for missing closings.
  • It repeatedly copies earlier document content into the output.
  • The expanding output can exhaust memory and processing power.

What to do

Run npm ls --all @xmldom/xmldom inside the application directory. Versions from 0.9.0-beta.1 through 0.9.11 are affected. Finding the package alone does not prove exposure because the application must process untrusted HTML in HTML mode.

Run this in the application environment you want to check:

npm ls --all @xmldom/xmldom

Update @xmldom/xmldom to version 0.9.12. Run the version check again and confirm no affected copy remains in the dependency tree.

Technical details

CVE-2026-83612 affects HTML-mode parsing and serialization in xmldom 0.9.x. Mixed-capitalization closing tags can make serialized output grow quadratically, consuming disproportionate CPU and memory. The flaw affects availability but does not disclose or alter data. Version 0.9.12 uses case-insensitive closing-tag matching and safely handles missing closing tags.

The separate 0.8.x code path does not have this amplification behavior.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes None No data tampering
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source