@xmldom/xmldom CVE-2026-83606

Exploitation requires that the target application uses @xmldom/xmldom in the version range 0.9.0-beta.9 through 0.9.10 and passes attacker-controlled data to DOMParser.parseFromString() under the library's default options - no non-default xmldom configuration is required. The CVSS vector PR:N/UI:N confirms no authentication and no user interaction are needed. Exploitation is limited to Node.js runtime environments (the library has no native bindings and is JavaScript-only) and strictly to the affected version range. Applications on versions prior to 0.9.0-beta.9 or on 0.9.11 and later are not affected. The key limiting factor for defenders is whether the application exposes an XML-parsing endpoint to unauthenticated or lightly authenticated callers - internal-only parsers with network-layer access controls reduce realistic exploitability despite the PR:N vector.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately characterizes a network-reachable exploit requiring no authentication, no special attack requirements, and no user interaction, with high availability impact on the vulnerable system. EPSS data was not supplied in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified; however, the attack mechanism is algorithmically simple - crafting a small malformed PI element with a whitespace tail - placing effective exploit effort near zero for any developer familiar with ReDoS techniques. No CISA KEV listing is indicated, and no separately published POC has been identified, meaning this is not confirmed as actively exploited at time of analysis. The real-world risk profile is more severe than a typical library-level DoS because Node.js operates a single-threaded event loop: one stalled regex call blocks all concurrent I/O, converting a per-request parse delay into a full service outage. Services accepting external XML in the affected version range, regardless of their scale, should treat patching as urgent rather than deferring to a scheduled maintenance window. The absence of scope change (SC/SI/SA:N) correctly reflects that the impact is contained to the parsing process itself, not propagated to downstream systems.

An attacker submits an HTTP request containing a small XML payload such as '<?foo ' followed by several thousand space characters and no closing ?>, targeting any endpoint that passes request body content to DOMParser.parseFromString(). The xmldom regex engine enters quadratic backtracking over the whitespace tail, blocking the Node.js event loop for seconds per request with only kilobytes of input, causing all concurrent requests to queue and the service to appear fully unresponsive. No public exploit code has been identified, but the advisory and patch diff make the attack trivially reproducible.