xmldom: Quadratic-time attribute deduplication

Published September 8, 2026 CVE-2026-83613

A bug in the xmldom package for Node.js lets someone freeze up an app or website just by sending one specially built but perfectly valid XML file. The file makes the program stall for seconds at a time, and a few of them sent together can knock the service offline.

Severity
HighCVSS 4.0 · 8.7
Fix
Fixed in 0.8.15Fix recorded 2 days ago
Affected versions
0.6.0 or older; 0.9.0 or newer, but before 0.9.12; 0.7.0 or newer, but before 0.8.15
Weakness
CWE-407
Exploit likelihood
0.34% in 30 daysEPSS, higher than 27% of known flaws
Affects
xmldom

How it works

  • xmldom is a JavaScript tool that other programs use to read and understand XML files.
  • When it reads a tag, it adds each attribute one at a time and checks it against every attribute already added, to make sure none repeat.
  • That checking gets dramatically slower as the number of attributes grows, so a tag with tens of thousands of attributes forces hundreds of millions of comparisons.
  • The file that triggers this looks completely normal and passes every check, so nothing blocks it before it reaches this slow process.
  • A single such file, only around 340 KB before compression, can tie up the server for one to two seconds per request, and doubling the attribute count roughly quadruples that time.

What to do

Run npm list @xmldom/xmldom or npm list xmldom in your project to see which package and version is installed. If it is @xmldom/xmldom between 0.7.0 and 0.8.14, or between 0.9.0 and 0.9.11, or you have any version of the plain xmldom package, your app can be slowed to a crawl by a single crafted XML file if it parses XML from outside sources.

Run this in the application environment you want to check:

npm list @xmldom/xmldom xmldom

Update @xmldom/xmldom to version 0.8.15 or 0.9.12 with npm install @xmldom/xmldom@0.9.12 (or @0.8.15 if you are on the 0.8 line). There is no fixed version for the older unscoped xmldom package, so switch to a maintained @xmldom/xmldom release if you still depend on it, and until then avoid parsing untrusted XML with it.

Technical details

xmldom: Quadratic-time attribute deduplication. xmldom builds the attribute collection of every parsed element by inserting attributes one at a time into a DOM NamedNodeMap.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes None No data tampering
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source