xmldom: End-tag Whitespace-Trim Regex ReDoS, quadratic backtracking in the 0.8.x end-tag parser

Published September 8, 2026 CVE-2026-83619

A flaw in @xmldom/xmldom can stall Node.js servers processing attacker-supplied XML. One crafted document can block the server without login access.

Severity
HighCVSS 4.0 · 8.7
Fix
Fixed in 0.8.15Fix recorded 2 days ago
Affected versions
0.7.0 or newer, but before 0.8.15
Weakness
CWE-400Uncontrolled Resource Consumption
Exploit likelihood
0.30% in 30 daysEPSS, higher than 23% of known flaws
Affects
xmldom

How it works

  • An attacker sends XML with a closing tag containing unusually long whitespace.
  • A final non-whitespace character makes xmldom repeatedly scan that whitespace.
  • Processing time rises sharply as the whitespace grows.
  • This blocks the Node.js event loop and stalls the server.
  • Default settings reach this code before checking whether the XML is valid.

What to do

Run npm ls --all @xmldom/xmldom from the application directory. Versions 0.7.0 through 0.8.14 are affected. Finding the package does not prove exposure unless the application accepts untrusted XML.

Run this in the application environment you want to check:

npm ls --all @xmldom/xmldom

Update the affected dependency to version 0.8.15. Repeat the version check and confirm that 0.8.15 is installed. Applications using 0.9.x require no change for this issue.

Technical details

CVE-2026-83619 affects the scoped npm package @xmldom/xmldom from 0.7.0 through 0.8.14. Its 0.8.x end-tag parser repeatedly scans attacker-controlled whitespace, causing processing time to grow rapidly as input grows. The documented impact is availability only. Version 0.8.15 changes the scan so processing time grows normally. The 0.9.x line never contained the affected code.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes None No data tampering
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source