xmldom CVE-2026-83613

No special conditions are required beyond the target application using @xmldom/xmldom prior to 0.8.15/0.9.12 or any version of the legacy xmldom package to parse XML originating from attacker-controllable input. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations. Exploitation is strictly limited to availability impact (event loop stall / denial of service); CVSS VC:N/VI:N confirms no confidentiality or integrity impact is possible. The stall magnitude scales with N² where N is the attribute count; on typical Node.js hardware, several thousand distinct attributes per element suffice for a perceptible stall. Applications that parse XML in a dedicated worker thread, or that enforce hard document-size or attribute-count caps before calling parseFromString, partially limit the blast radius but do not eliminate the vulnerability.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:H accurately characterizes the threat: no authentication, no configuration precondition, and no user interaction are required - any network path to an XML-consuming endpoint is sufficient. In Node.js, blocking the event loop is especially severe because it freezes all concurrent request handling, making a single malicious request capable of producing application-wide unavailability. No EPSS data was supplied in the input; without it, empirical exploitation probability cannot be stated, but the attack surface is broad (any HTTP API accepting XML, SOAP services, XML-based configuration processors) and the trigger condition is trivially met. The absence of a CISA KEV entry and the lack of observed public POC code suggest exploitation has not yet been observed at scale, though the advisory detail is sufficient for any competent attacker to weaponize. The legacy xmldom package will never receive a patch, creating a permanent risk for downstream consumers who have not migrated.

An attacker identifies an HTTP API endpoint that accepts XML payloads and is backed by a Node.js service using an affected xmldom version. The attacker submits a single HTTP request containing a valid XML document with one element bearing several thousand distinct attribute names. The parser begins attribute insertion, triggering millions of O(N²) linear lookups inside NamedNodeMap before the application's input validation layer is reached, stalling the event loop for seconds to minutes and preventing the process from handling any other request during that window.