Executive brief
libxmljs is a Node.js library used to parse and manipulate XML documents. A vulnerability allows attackers to crash applications that use this library by triggering a segmentation fault when parsing specially crafted XML files containing entity declarations. This denial-of-service attack requires only a malicious XML file and results in complete service unavailability.
Technical details
The vulnerability is a segmentation fault (CWE-400: Uncontrolled Resource Consumption) in libxmljs version 1.0.11 that occurs when accessing the internal _ref property on entity_ref and entity_decl nodes after parsing a specially crafted XML document. The root cause stems from improper handling of XML entity references—when an attacker provides an XML file with entity declarations and the application accesses the _ref property directly (either via property access, console.log, or Object.getOwnPropertyNames), the library dereferences an invalid pointer, causing the process to crash. The attack requires only network/file access to provide a malicious XML document (no authentication or user interaction needed) and affects all versions up to and including 1.0.11. The impact is denial of service through application crash; potential for further memory corruption and data leakage has been noted but not demonstrated.
Affected products
- libxmljs libxmljs up to and including 1.0.11
Timeline
- 2025-01-09: disclosed: Issue reported on GitHub
- 2025-12-26: advisory: Security advisory published