xmldom CVE-2026-83619

The target application must use @xmldom/xmldom at a version between 0.7.0 and 0.8.14 and must pass attacker-controlled content to DOMParser.parseFromString() under default parser options - no special non-default configuration is required on the xmldom side. The crafted payload must contain an XML end tag with a long run of ASCII whitespace characters (spaces, tabs, newlines, or carriage returns) immediately followed by at least one non-whitespace character, which triggers the unanchored regex's quadratic retry loop. No authentication is required - CVSS PR:N confirms any unauthenticated HTTP endpoint, webhook receiver, or file-upload handler that parses XML with affected xmldom versions is vulnerable. Exploitation is bounded by: (1) the 0.8.x release line only - 0.9.x and unscoped npm do not contain the vulnerable expression; (2) impact is purely availability - no code execution, data exfiltration, or integrity compromise is possible; and (3) applications that enforce strict payload size limits or XML structural pre-validation upstream of xmldom can reduce but not eliminate exposure without patching.

The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N yields a score of 8.7, representing the highest realistic risk tier for a DoS-only vulnerability: network-reachable, no authentication, no special attack requirements, no user interaction. Real-world priority is significant for any Node.js application that exposes an endpoint accepting XML and processes it with affected xmldom versions, since complete event loop stall causes total service disruption rather than degraded throughput. The attack is highly automatable: a single short XML string suffices and can be replayed at negligible bandwidth. Mitigating factors include: impact is limited strictly to availability with no confidentiality or integrity exposure; exploitation is not confirmed in CISA KEV; and no public proof-of-concept code is present in the provided intelligence. EPSS data is absent from the supplied data, so probabilistic exploitation likelihood cannot be quantified. Applications that validate XML payload length upstream of the parser or that offload xmldom parsing to a worker thread with a timeout substantially reduce exposure without patching.

An attacker sends a small HTTP POST body containing a valid XML document whose closing element tag embeds several hundred whitespace characters followed by a trailing non-whitespace byte - for example, </tag[300 spaces]x> - to any endpoint that passes the raw body into DOMParser.parseFromString(). The V8 regex engine backtracks quadratically through the whitespace run, stalling the Node.js event loop for seconds to minutes and causing all concurrent requests to time out; the attack requires no authentication and can be sustained from a single low-bandwidth connection.