Which versions of xmldom are affected by CVE-2026-83615?

Applications using the unmaintained legacy `xmldom` package (versions 0.1.5-0.6.0) are vulnerable to denial of service through malicious XML documents that exhaust Node.js process memory.. A patch is available.

How to fix or mitigate CVE-2026-83615?

Within 24 hours: Scan all Node.js applications and deployments to identify dependencies on legacy `xmldom` versions 0.1.5-0.6.0 using software composition analysis or manual package audits; document affected services and their business criticality. Within 7 days: Begin migration of affected applications to `@xmldom/xmldom` version 0.8.15 or later; test in staging environments before production deployment to verify compatibility. Within 30 days: Complete migration of all affected systems to the patched version or fully remove `xmldom` from the dependency tree; update continuous integration scanning to block future use of the unmaintained `xmldom` package.

xmldom CVE-2026-83615

Q: What is the CVSS score of CVE-2026-83615?

CVE-2026-83615 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-69236 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-09-01 GitHub_M

Denial Of Service Xmldom

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable via default DOMParser API with no authentication or user interaction; impact is availability-only heap exhaustion with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 01, 2026 - 16:02 EUVD

Source Code Evidence Fetched

Sep 01, 2026 - 15:24 vuln.today

Analysis Generated

Sep 01, 2026 - 15:24 vuln.today

CVE Published

Sep 01, 2026 - 14:44 cve.org

HIGH 8.7

DescriptionCVE.org

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses _copy to clone the complete currentNSMap for each nested element that declares a new namespace prefix. Keeping every ancestor map live on the parse stack creates quadratic peak namespace-map storage, so a small highly compressible XML document can exhaust the process heap before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

AnalysisAI

Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js process heap by sending a compact, crafted XML document with repeated namespace prefix declarations. The unmaintained legacy xmldom package (versions 0.1.5-0.6.0) has no available fix, while @xmldom/xmldom is patched in releases 0.8.15 and 0.9.12. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special server configuration is required - the vulnerability is triggered by the default behavior of `DOMParser.parseFromString` in any xmldom version within the affected range. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:H accurately reflects the threat model: any network-reachable endpoint that parses attacker-controlled XML with xmldom is exploitable without credentials or user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	For users of `@xmldom/xmldom`, upgrade to version 0.8.15 (https://github.com/xmldom/xmldom/releases/tag/0.8.15) or 0.9.12 (https://github.com/xmldom/xmldom/releases/tag/0.9.12) immediately, as confirmed by the GitHub advisory GHSA-965w-775f-mr7g. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Scan all Node.js applications and deployments to identify dependencies on legacy xmldom versions 0.1.5-0.6.0 using software composition analysis or manual package audits; document affected services and their business criticality. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Xmldom

View all

CVE-2022-39353 CRITICAL Act Now POC

9.8 Nov 02

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. Rated crit

CVE-2026-83610 MEDIUM This Month POC

6.3 Sep 01

XML injection via EntityReference in xmldom enables attacker-controlled XML markup to escape entity-reference boundaries

CVE-2022-37616 CRITICAL Act Now

9.8 Oct 11

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) pa

CVE-2026-83619 HIGH This Week

8.7 Sep 01

ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event

CVE-2026-83618 HIGH This Week

8.7 Sep 01

XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType vali

CVE-2026-83617 HIGH This Week

8.7 Sep 01

XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScr

CVE-2026-83616 HIGH This Week

8.7 Sep 01

Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through u

CVE-2026-83614 HIGH This Week

8.7 Sep 01

Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenti

CVE-2026-83613 HIGH This Week

8.7 Sep 01

Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against

CVE-2026-83612 HIGH This Week

8.7 Sep 01

Quadratic CPU and memory exhaustion in @xmldom/xmldom 0.9.0-beta.1 through 0.9.11 allows denial-of-service via small cra

CVE-2026-83609 HIGH This Week

8.7 Sep 01

XML injection in @xmldom/xmldom 0.9.0-0.9.11 allows an attacker to embed malicious markup into serialized XML output by

CVE-2026-83608 HIGH This Week

8.7 Sep 01

XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely cl

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all

CVE-2017-8779 HIGH POC

7.5

CVE-2025-53521 CRITICAL POC

9.3

CVE-2017-5850 HIGH POC

7.5

CVE-2025-26682 HIGH

7.5

CVE-2025-41770 HIGH

8.7

CVE-2025-26466 MEDIUM

5.9

CVE-2020-37067 CRITICAL POC

9.8

CVE-2021-47875 CRITICAL POC

9.8

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7	Not-Affected
SUSE Linux Enterprise Server 15 SP7	Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

CVE-2026-83615 vulnerability details – vuln.today

Back

xmldom CVE-2026-83615

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Xmldom

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code