xmldom: Quadratic-time parsing

Published September 8, 2026 CVE-2026-83614

A bug in the xmldom code library lets a tiny, badly formatted XML file freeze up a website or app for several seconds. Any service that uses xmldom to read XML from outside senders can be stalled by one request.

Severity
HighCVSS 4.0 · 8.7
Fix
Fix not establishedNo fixed release identified in this report
Affected versions
0.3.0 or newer and 0.6 or older; 0.7.0 or newer, but before 0.8.15; 0.9.0 or newer, but before 0.9.12
Weakness
CWE-400Uncontrolled Resource Consumption
Exploit likelihood
0.35% in 30 daysEPSS, higher than 28% of known flaws
Affects
xmldom

How it works

  • xmldom tries to recover instead of stopping when it hits XML with a broken tag.
  • It backs up one character at a time and tries again, and each retry re-scans a large chunk of the file, so a file packed with many broken tags takes far longer to process than its size suggests.
  • A second, separate weak spot works the same way: after parsing, xmldom cleans up the document by joining neighboring bits of text together, and doing that for a long chain of tiny text pieces also takes much longer than it should as the chain grows.
  • A single crafted file, only tens of thousands of characters, can trigger both weak spots at once and occupy the server for several seconds.
  • The same text-joining step can also be triggered directly by an app's own code, without ever parsing a file, if that app builds a document out of many small text pieces and then calls the cleanup step itself.

What to do

Check which version is installed by running npm list @xmldom/xmldom or npm list xmldom in the project folder and compare it against the affected ranges above. If the app parses XML from outside users, customers, or partners with xmldom's default settings, or builds a document from many small text pieces and later calls its own cleanup step, it can be stalled by this issue. Update to @xmldom/xmldom version 0.8.15 (for the 0.8.x line) or 0.9.12 (for the 0.9.x line) with npm install @xmldom/xmldom@0.9.12 or npm install @xmldom/xmldom@0.8.15, matching whichever line the project already uses. The older, unscoped xmldom package has no fixed version at all. The supplied evidence does not establish a remediation path for projects still using that package name beyond the advisory itself.

Run this in the application environment you want to check:

npm list @xmldom/xmldom xmldom

There is no fix for the unscoped xmldom package; consult the GitHub advisory for further guidance on that line. For @xmldom/xmldom, updating to 0.8.15 or 0.9.12 closes both quadratic-time bugs without changing parsed output, only the reported error text differs.

Technical details

CVE-2026-83614 covers two independent O(n squared) code paths in xmldom's default-options DOMParser.parseFromString. Finding A: parseElementStartPart's malformed-tag single-character error-recovery re-scans forward to the next '' on every retry, an O(n) scan repeated O(n) times. Finding B: normalize, called automatically by endDocument after parsing and also callable directly on any programmatically built DOM, merges adjacent text nodes with a per-merge removeChild (O(K) reindex) and appendData (O(K) string rebuild), costing O(K squared) over K adjacent text nodes.

A single crafted document combining both findings, tens of KB in size, can stall the Node.js event loop for multiple seconds. Impact is availability only. Fixed in @xmldom/xmldom 0.8.15 and 0.9.12; no fixed version exists for the unscoped xmldom package.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes None No data tampering
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source