xmldom CVE-2026-83614

Both quadratic DoS paths are reachable via the default DOMParser.parseFromString() call with absolutely no special configuration required. The first path (SAX parser in lib/sax.js) is triggered by any malformed tag name containing characters that cause single-character recovery mode - no non-default parser options are needed. The second path (normalize() in lib/dom.js) is triggered automatically via endDocument() at the conclusion of every parse, or can be triggered by a direct normalize() call on a programmatically constructed DOM with adjacent text nodes. No authentication is required per the CVSS PR:N metric. Exploitation is bounded to denial of service (availability only); there is no path to code execution or data disclosure. The attacker must have network access to any endpoint that processes XML input through these libraries.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately reflects that both quadratic DoS paths are reachable over the network without authentication or special configuration, through the standard DOMParser.parseFromString() interface. Impact is limited entirely to availability - there is no confidentiality or integrity exposure. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified; however, this CVE is not listed in CISA KEV and no public exploit code has been confirmed at time of analysis. The real-world risk is concentrated in services that accept and parse untrusted or attacker-supplied XML, such as API gateways, document processors, and XML-accepting web endpoints. The legacy xmldom package (0.3.0-0.6.0) has no available fix, creating a permanent exposure for any deployment still using it. The combination of two independent O(N²) paths, both reachable without privileges, means even moderate-sized crafted inputs can cause disproportionate resource consumption - the risk is practical and not merely theoretical for any internet-facing service parsing user-controlled XML.

An attacker sends an HTTP request containing a crafted XML payload with a malformed tag name (e.g., an element name containing an embedded < character) to any web service that passes request bodies through DOMParser.parseFromString(). The SAX parser's recovery loop rescans the malformed name character-by-character in O(N²) time, causing CPU to spike proportionally to the square of the payload length. By repeating requests with payloads sized in the tens of kilobytes, an attacker can sustain CPU exhaustion on the target without any authentication.