Skip to main content

xmldom CVE-2026-83614

| EUVDEUVD-2026-69234 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-09-01 GitHub_M
Denial Of Service Xmldom Red Hat Suse
8.7
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable via default parse call with no privileges or interaction needed; impact is availability-only with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Sep 01, 2026 - 16:02 EUVD
Source Code Evidence Fetched
Sep 01, 2026 - 15:08 vuln.today
Analysis Generated
Sep 01, 2026 - 15:08 vuln.today
CVE Published
Sep 01, 2026 - 14:41 cve.org
HIGH 8.7

DescriptionCVE.org

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically constructed DOM, and endDocument invokes that normalization after parsing. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

AnalysisAI

Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenticated callers to exhaust CPU and memory by submitting crafted XML. The @xmldom/xmldom package before versions 0.8.15 and 0.9.12, and all versions of the legacy xmldom package (0.3.0-0.6.0), expose both paths through the default DOMParser.parseFromString() interface, requiring no authentication or special configuration. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Both quadratic DoS paths are reachable via the default `DOMParser.parseFromString()` call with absolutely no special configuration required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately reflects that both quadratic DoS paths are reachable over the network without authentication or special configuration, through the standard `DOMParser.parseFromString()` interface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Users of `@xmldom/xmldom` should upgrade to version 0.8.15 (https://github.com/xmldom/xmldom/releases/tag/0.8.15) or 0.9.12 (https://github.com/xmldom/xmldom/releases/tag/0.9.12) as applicable to their branch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct a complete inventory of all Node.js applications and dependencies using @xmldom/xmldom versions prior to 0.8.15 or 0.9.12, or legacy xmldom versions 0.3.0-0.6.0, using npm audit, SBOM analysis, or custom dependency scanning. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Xmldom

View all
CVE-2022-39353 CRITICAL POC
9.8 Nov 02

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. Rated crit
CVE-2026-83610 MEDIUM POC
6.3 Sep 01

XML injection via EntityReference in xmldom enables attacker-controlled XML markup to escape entity-reference boundaries
CVE-2022-37616 CRITICAL
9.8 Oct 11

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) pa
CVE-2026-83615 HIGH
8.7 Sep 01

Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js
CVE-2026-83608 HIGH
8.7 Sep 01

XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely cl
CVE-2026-83605 HIGH
8.7 Sep 01

XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during s
CVE-2026-83613 HIGH
8.7 Sep 01

Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against
CVE-2026-83618 HIGH
8.7 Sep 01

XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType vali
CVE-2026-83619 HIGH
8.7 Sep 01

ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event
CVE-2026-83617 HIGH
8.7 Sep 01

XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScr
CVE-2026-83616 HIGH
8.7 Sep 01

Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through u
CVE-2026-83612 HIGH
8.7 Sep 01

Quadratic CPU and memory exhaustion in @xmldom/xmldom 0.9.0-beta.1 through 0.9.11 allows denial-of-service via small cra

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected

Share

CVE-2026-83614 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy